← Back to AM3 Blog

The Email Came From Someone They Trusted. That Was the Problem.

It looked like any other Monday morning email. A school the employee worked with had sent over a "new submission" to review. She opened it, replied, and got on with her day.

Seventy-one days later, her mailbox sent a phishing email to her outside contacts while she was on vacation. Only then did anyone realize an attacker had been inside her Microsoft 365 account all summer.

Multi-factor authentication (MFA) was turned on the entire time. Here is how the attack worked, why MFA did not stop it, and what would have caught it on the very first morning.

The First Two Minutes

The email came from a real address at a real partner organization. That partner's own mailbox had most likely been compromised first, which is why the message looked completely normal.

While she was handling it, the attacker tricked her into approving a genuine Microsoft sign-in prompt. Within two minutes, they had done three things:

• Signed in to her account and passed the MFA check she approved
• Added their own computer to her account, named simply "Work PC"
• Created a hidden inbox rule that filed away every future email from the partner organization

That last step was clever. If the partner ever tried to warn her that their account had been hacked, she would never see it. And it worked: replies in that thread sat hidden for ten weeks.

Six Weeks of Silence

Then nothing happened. For six weeks there was no recorded activity at all. The attacker did not need to do anything, because the computer they had added to her account kept their access alive.

When they came back, they brought automation. A script began reading her mailbox every single day: the inbox, sent items, drafts, deleted items and her folders for the schools she worked with. By the end, the attacker had read more than 1,100 emails, including correspondence with schools, families and program participants.

Setting the Trap

In the final week, the attacker moved from reading to preparing. They signed in through Outlook on the web, opened an account with an outside email service in her name, and set a rule to automatically delete the sign-up notices so she would not notice.

Then they waited for the perfect moment: her vacation. Minutes after she was out of the office, the attacker:

• Turned off her real out-of-office reply and replaced it with "Please sign the documents that were sent and return them to us"
• Sent a phishing email with a PDF attachment to her contacts, reusing the same "new submission" theme that had fooled her
• Created a rule to bury all new incoming mail
• Replied to one recipient who responded, then deleted 42 bounce-backs, auto-replies and sent copies to cover their tracks

One copy of that phishing email reached our help desk. That is what exposed the attack.

Why MFA Didn't Stop It

MFA did exactly what it was designed to do: it asked for confirmation. The problem is that the employee gave it, because the prompt was real and the request looked routine.

This type of attack does not steal a password. It gets the user to approve a sign-in, then registers a device that Microsoft trusts from that point on. That device keeps generating fresh access for weeks, with no new password or MFA prompt needed.

This is also why a password reset alone would not have been enough. Our team blocked the account within two hours of the alert, but the real fix was deleting the attacker's "Work PC" from the account, then resetting all sessions, MFA methods and inbox rules.

The Warning Signs Were There on Day One

Within two minutes on that first morning, the account showed several classic alerts:

• Sign-ins from unfamiliar networks
• A new, unknown device registered to the user
• An inbox rule built to hide mail from one specific sender

Any one of these is a standard trigger for a security monitoring service. Later, the daily script, the deleted sign-up notices and the out-of-office change were more chances to catch it. Nobody was watching, so none of them were caught.

What Your Business Can Do

• Treat "review this" emails with care, even from people you know. If a trusted contact sends something unexpected, confirm by phone.
• Never approve a sign-in prompt you didn't start. If an MFA request appears out of nowhere, deny it and tell IT.
• Check your account for devices you don't recognize. Unknown devices are one of the clearest signs of a takeover.
• Watch your Microsoft 365 accounts in real time. Continuous monitoring catches new devices, odd sign-ins and hidden inbox rules in minutes, not months.