Home › Blog › Account takeover
Security · field report · 23 September 2026 · 14 min read
Most companies believe that once multi-factor authentication is on, their email is safe. This is the incident that proves otherwise, reconstructed from cases we have investigated: one approved push notification, one stolen session, four days of quiet reading, and then seventy-odd fraudulent emails into real conversations with customers and suppliers. The MFA prompt was genuine. So was the sign-in page, almost.
A composite of incidents we have investigated for clients. Times, counts and wording have been altered; the sequence has not.
A company asked us to investigate after one of its employees found a large number of emails in his sent items that he had never written. We were asked to establish what had happened, contain it and work out how far it had spread. What we found: the employee had entered his password and approved an MFA prompt exactly as he had done hundreds of times before. Within minutes, someone was reading his mailbox from another continent. Four days later, they used his account to send more than seventy fraudulent emails to around fifty of the company’s customers and suppliers, and then answered their questions in real time.
Multi-factor authentication was enabled the whole time. Here is how it happened, what attackers do with a mailbox once they are inside, and how to defend, investigate and recover.
The timeline, in one time zone
| When | What happened |
|---|---|
| Day 0, late afternoon | A phishing email titled “Performance review” arrives from a genuine company in the same country whose own mailbox had been compromised the week before. Real domain, valid SPF and DKIM. It lands in three inboxes; the filter catches one, two are delivered. |
| Day 1, morning | The employee opens the attachment on his phone and follows the link to what looks like the Microsoft sign-in page. It is a reverse proxy sitting between him and Microsoft, relaying every keystroke. |
| Seven minutes later | He types his password and approves the push notification. Microsoft issues a valid session token. The proxy captures it. |
| Three minutes later | The token is replayed from a VPN exit. The attacker is inside Outlook on the web, OneDrive, SharePoint and Teams, with no password prompt and no MFA challenge. |
| One minute later | The attacker opens the security-info page and registers their own authenticator on a phone the employee has never owned. They no longer depend on the stolen token: they hold a legitimate second factor on someone else’s account. |
| Days 1 to 4 | Two attacker sessions, from two countries, read the mailbox daily. They search it, open attachments and browse OneDrive. No mail is sent. The user notices nothing. |
| Day 5, early afternoon | An automated tool fires more than seventy replies into existing conversations, one every half-minute: invoices, purchase orders, overdue payments, annual contracts. Recipients reply with questions; the attacker answers within minutes. When one supplier asks outright whether the message is spam, they get a reassuring reply from a real company address, inside a real thread. |
| Day 5, evening | Sessions revoked, password reset, every MFA method removed including the attacker’s phone, sign-in blocked. Two attempts to get back in over the next five minutes fail. |
Dwell time: four and a half days. Damage: an unknown quantity of mail read, around fifty business contacts exposed to a phishing and payment-fraud attempt, and a data-breach assessment under GDPR.
Adversary-in-the-middle phishing. The technique above. Kits such as Evilginx, EvilProxy and Tycoon 2FA proxy the real Microsoft sign-in page, so the victim sees a genuine page with a genuine MFA prompt. The attacker steals the session cookie rather than the password. Any second factor that can be relayed — push, SMS, one-time codes — can be bypassed this way.
QR-code phishing. The link is inside a QR code in a PDF or an image. The employee scans it with a personal phone, which is outside the company’s link scanning, endpoint protection and device policies.
Compromised supplier mailboxes. The most effective phishing rarely comes from a lookalike domain. It comes from a real partner whose account was taken over last week. Your filters see a trusted sender with valid authentication records.
MFA fatigue. Repeated push notifications until the user taps approve to make them stop, often in the middle of the night.
Infostealer malware. Browser-stored passwords and session cookies harvested from an infected machine and sold. No phishing needed.
OAuth consent phishing. The victim authorises an innocuous-looking application. Granting it gives permanent mailbox access through a token that survives password resets.
Password spray. One common password tried against many accounts, under the lockout thresholds. Legacy protocols that cannot do MFA are the usual entry.
Helpdesk social engineering. A phone call to IT asking to reset MFA for a lost phone.
The sending of spam is the last step, not the first. Before it comes a quiet reconnaissance phase, which is where the money is.
Persistence. Register a new MFA device, create hidden inbox rules, add forwarding to an external address, grant delegate access, consent to a malicious application. Several of these survive a password reset, which is why a password change alone is not containment.
Concealment. Inbox rules that move or delete anything containing “invoice”, “payment”, “phishing”, “hacked” or “spam”, typically into RSS Feeds, Archive or Conversation History. The user never sees the replies of confused customers. In the case above, the attacker also deleted their own sent copies.
Reconnaissance. Mailbox searches for “bank”, “IBAN”, “remittance”, “wire”, “PO”, “quote”. Attachments downloaded. OneDrive and SharePoint browsed. Increasingly, attackers use the company’s own AI assistant to summarise the mailbox for them, which is far faster than reading it.
Monetisation, where the scenarios diverge:
Training helps, and a phishing simulation tells you your click rate; no training programme stops every click. The goal is to make a stolen credential and a stolen session useless.
This is the part most businesses discover at the worst moment. In Microsoft 365, the strongest protections and much of the forensic evidence are tied to licences, and neither can be bought after the fact.
What each plan gives you, for defence and for evidence
| Plan | Defence | Evidence |
|---|---|---|
| Business Basic and Business Standard | MFA and security defaults. No Conditional Access, no device compliance: you cannot require managed devices or protect MFA registration. | Standard audit and message trace; sign-in logs kept for seven days. |
| Business Premium and Microsoft 365 E3 | Entra ID P1 with Conditional Access, named locations and authentication strengths; Intune for device compliance and app protection on phones; Defender for Office 365 Plan 1. Nearly every control above becomes available here. | Sign-in logs kept for thirty days; standard audit. |
| Microsoft 365 E5, or the add-ons | Entra ID P2: risk-based policies that block or challenge a suspicious sign-in on their own, and privileged identity management. Defender for Office 365 Plan 2: threat explorer, automated investigation and response. | Audit Premium: a year of retention and the finer events. |
Two things about evidence that catch people out. Since 2024, standard auditing records mailbox access, sends and searches for every licence, so the question is no longer whether those events exist but for how long: a hundred and eighty days on the standard tier, a year with Audit Premium. And sign-in logs, which are where the theft itself shows, are kept for seven days without Entra ID P1. In the case above, the investigation began inside the window and the sessions could be reconstructed to the minute. A week later, the sign-in evidence would have been gone.
The consequence is not academic. Without evidence of what was opened, the only defensible position for a breach assessment is the worst case: every message in the mailbox and every file the user could reach was exposed. That makes the notification decision harder, the customer conversations longer and the reputational damage larger, and it makes it impossible to reassure a specific customer that their data was not touched. Audit and Conditional Access licences cost a fraction of the incident response, the legal review and the lost trust that follow a takeover.
Work from these four sources, in this order.
Then reconstruct a timeline in one time zone and write it down. Regulators, insurers and customers will all ask for it.
This attack did not defeat a technical control. It used one legitimate token, one approved push notification and four days of patient reading. The defences that would have stopped it are ordinary and inside licences many businesses already own — Business Premium carries all of them: managed devices, protected MFA registration, phishing-resistant authentication, and a rule that bank details are never changed on the strength of an email. And when prevention fails, how bad the aftermath is comes down to how much evidence the tenant was keeping before anyone knew there was a problem.
Everything in this article — the containment in the right order, the four sources of evidence and the timeline, the persistence hunt, the breach assessment, and the hardening switched on in report-only mode first so that nobody is locked out — is what our incident response and hardening service does. If it is happening now, call the number in the header; if it is not yet, the hardening costs a fraction of the week described above.
Yes: it stops password spray, credential stuffing and every attacker who is not running a proxy kit. What it does not stop on its own is a relayed session, which is what Conditional Access on managed devices and phishing-resistant methods are for.
No. A stolen session token keeps working after a reset until sessions are revoked, and a registered authenticator, an inbox rule or an application consent survives it. Revoke first, then reset, then hunt.
For the defence, yes: Entra ID P1, Intune and Defender for Office 365 Plan 1 are inside it. For the investigation, sign-in logs are kept thirty days with P1 and standard audit a hundred and eighty; the premium audit tier and Defender Plan 2 are add-ons or E5.
Seventy-two hours from becoming aware of a notifiable breach. The decision whether it is notifiable is made with the evidence from the logs and documented either way; that is why the evidence matters.