Phishing Attack Bypasses MFA to Steal Vendor Payments via Microsoft 365

A recent business email compromise (BEC) attack exploited a phishing email to hijack a finance user's Microsoft 365 session token, allowing the attacker to reroute vendor payments. The spear-phishing email, themed around a denied PTO request, was tailored to the victim, including their name and job title. Upon clicking a malicious link, the attacker gained access to the user's session, bypassing multi-factor authentication (MFA) without installing malware. The attacker then created malicious inbox rules to conceal their activities, auto-archiving incoming emails related to vendor payments. This sophisticated attack highlights the evolving nature of BEC threats, which now leverage advanced tactics to exploit trust and identity. The incident was confirmed by cybersecurity firm TrendAI, which noted the attack's low footprint and high impact on financial operations. Organizations are urged to enhance their security measures to combat such sophisticated phishing schemes.

Key Points: • Attackers hijacked a Microsoft 365 session token through a spear-phishing email. • The phishing email impersonated HR and bypassed MFA without malware installation. • Malicious inbox rules were created to conceal fraudulent activities from the victim.