The initial compromise leveraged an adversary-in-the-middle (AiTM) phishing technique for initial access, providing the attacker with access to the executive’s account and mailbox. Indicators of Compromise Analysisĭuring the investigation, Mitiga identified unauthorized access to the Microsoft 365 user of an executive in the organization from multiple locations (including Singapore, Dubai, andSan Jose, California). While the alertness of the involved parties prevented the fraud, the attack indicated that the attacker had access to sensitive information that could only be obtained by compromising a user in the organization. Mitiga investigated an attempted Business Email Compromise (BEC) attack. These weaknesses effectively nullify the added security allegedly provided by multi-factor authentication (MFA), allowing for full compromise, even of accounts that have enabled MFA. Mitiga spotted a sophisticated, advanced business email compromise campaign, targeting Microsoft 365 organizations, leveraging inherent weaknesses in Microsoft 365 MFA, Microsoft Authenticator, and Microsoft 365 Identity Protection.

365 mfa