Business Email Compromise (BEC) - Office 365 Account Hijack

Fraudulent payment requests sent from the client's official mailbox to customers.

Incident
Our client reported unauthorized emails originating from their corporate Office 365 account. The messages impersonated legitimate invoicing and instructed customers to transfer funds to an attacker-controlled account.

Immediate Actions

• Verified unauthorized sending activity and confirmed compromise indicators (unrecognized sessions, suspicious forwarding rules).
• Instructed immediate credential reset and enforced multi-factor authentication (MFA) for the affected account and admin users.
• Disabled all suspicious mailbox forwarding and removed malicious inbox rules and delegates.
• Invalidated active sessions and revoked refresh tokens to cut attacker access.

Containment Note
We coordinated with the client to contact recipients who received the fraudulent requests and advised them to halt any pending transfers and verify payment instructions via phone or secure channel.

Request secure incident briefing (NDA)

Response, Remediation & Hardening

Secured the account, stopped fraudulent activity, and improved detection/prevention.

Response & Remediation

• Performed full mailbox and tenant review to identify persistence mechanisms (inbox rules, app permissions, OAuth grants).
• Removed attacker-controlled apps and revoked suspicious OAuth permissions and API keys.
• Applied conditional access policies and MFA enforcement; limited legacy auth where possible.
• Enabled mailbox auditing, advanced logging and alerting for anomalous send/forward patterns.

Outcome
Compromise was contained, no further fraudulent transfers occurred after containment steps, and affected customers were notified. The client received an updated incident playbook and technical remediation report.

Key Takeaway
Rapid containment (credential reset + revoke tokens + remove mailbox rules) combined with proactive customer communication is essential to preventing BEC financial losses.

Contact us to request the full technical report (NDA required)