Attackers are blending commodity loaders, infostealers and remote access tooling into faster...
Read more: The Keys Behind the Apps Your IT Provider Connects to Microsoft 365
Security researchers at ANY.RUN tracked a phishing campaign they call CSuite across 351 sandbox analyses, and just over half of those submissions came from the United States. The lures are the documents your office handles every day: a DocuSign envelope, an Adobe file, a Zoom invite, a Dropbox share. One of them was a forged signature request sent in a law firm's name. What sets this campaign apart is what a single click leaves behind. Not one problem, but two.
The first problem is the mailbox. The lure pushes the victim into a Microsoft 365 sign-in, sometimes by asking them to type a short code into Microsoft's real login page. The victim signs in for real and completes multi-factor authentication for real. The attacker's waiting software collects the session tokens that come out the other end. Multi-factor checks the moment of sign-in; the tokens issued afterward are an already-trusted session, and replaying them opens the mailbox with no second prompt. Nothing in your logs shows a failed password attempt, because no password was ever guessed. Resetting the password does not end a session that is already live.
The second problem is the computer. In one case the lure delivered a small script that elevated its own permissions and installed ScreenConnect, a genuine remote-management product that IT departments buy and use. Action1, another real product, is used in the campaign as well. The software is signed by its vendor, registers itself as a normal Windows service, and calls home to the vendor's own cloud, which many firms already allow through their firewall. Antivirus generally does not flag it, because it is not malware. It is a legitimate remote-control tool that now belongs to someone else.
That is why the cleanup is two separate jobs. Revoke the stolen session and the attacker still has the remote-control agent. Remove the agent and the attacker still has the mailbox. Close only one and you have left a door open.
An attacker reading a live executive or finance mailbox sees the supplier you already pay, the amount you already owe, and the tone your controller already uses. A message asking to update remittance details arrives mid-thread from the correct sender, and accounts payable approves it because every prior signal checks out. Money leaves under a legitimate approval, which limits what your bank can reverse and starts your insurer asking what controls failed.
The damage then moves outward. Compromised accounts get used to phish colleagues, partners, and clients from your real domain, with your real email authentication passing. Explaining to a client that their staff clicked on something that came from you tends to reach the commercial relationship.
The campaign's exposure clustered in technology, manufacturing, government, and consulting, but the mechanics are generic. A dental practice, a law office, and an accounting firm all run on supplier payment chains and client correspondence, and all three sign documents electronically.
Five things, in order. The first three are for whoever manages your Microsoft 365 tenant.
And one sentence for staff: a signature request you were not expecting is a phone call, not a click.
For regulated firms, notification obligations commonly follow what the attacker could reach, not what you can prove they took. An executive mailbox holds employee records, client personal data, and whatever else passed through it. Knowing whether you could reconstruct what was read is worth checking before you need to.
The full breakdown, including the exact indicators your IT provider should hunt for, is in our Threat Intelligence Center write-up. If you are not sure which remote-access tools are installed across your firm right now, a security assessment will produce that list.
Microsoft has taken down EvilTokens, a phishing service that broke into more than 12,000 Microsoft 365 mailboxes at more than 10,000 organizations, including healthcare, financial services, construction, and real estate firms. The victims did not type their password into a fake page. They typed a short code into Microsoft's real login page, approved their own multi-factor prompt, and handed a criminal their mailbox. Here is how that works, and what a small firm on Microsoft 365 should change this week.
Microsoft 365 has a legitimate sign-in method for devices that cannot show a login page, like conference room screens and smart TVs. The device displays a short code, and you enter it on Microsoft's own website to link the device to your account. EvilTokens generated those codes on the attacker's side and sent them to victims in tailored phishing messages. The victim went to the genuine Microsoft page, entered the code, and completed multi-factor authentication normally, because it really was their own sign-in. The access token that came out the other end went to the criminal.
Nothing about that looks wrong to the victim or to a basic security review. The password is never captured and never changes. Multi-factor succeeds. And because the platform kept refreshing that token in the background, a password reset alone did not evict the intruder. The mailbox could show no failed logins and no password change while someone else read it every day.
EvilTokens was a subscription product: $1,500 to sign up and $500 a month for a dashboard, sold on Telegram. Its selling point was an "analyst" chatbot that read each compromised mailbox and worked out who approves payments, which vendor relationships carry trust, and which invoices were in flight. It then recommended who to impersonate and helped draft the fraudulent message, written from real conversations in the style the recipient already expects.
That is ordinary business email compromise, the fake "our bank details have changed" invoice, made available to buyers with no skill at it. It also retires the advice most staff training still gives. Bad grammar, a generic greeting, or odd branding are no longer reliable warning signs, because the message is built from your own correspondence and sent from a real colleague's real account.
The industries hit had nothing in common except mailboxes that contained payment conversations. For a practice, a law firm, or an accounting office, that describes most of the partners and the whole billing department.
Five changes for whoever manages your Microsoft 365 tenant.
Tell staff one rule, too: if a message gives you a code and asks you to enter it on a Microsoft sign-in page, do not enter it. A real device code is shown on the screen of the device in front of you.
For regulated firms there is one more consideration. Once attacker tooling has read a mailbox, the client correspondence, patient messages, or payroll threads inside it count as exposed whether or not any payment was redirected, and notification obligations commonly attach to that exposure. Knowing whether you could tell which mailboxes were read is worth checking before you need to.
The full breakdown, including the detection signals your IT provider should alert on, is in our Threat Intelligence Center write-up. If you are not sure whether device-code sign-in is open in your tenant, a security assessment will tell you.
Page 1 of 4
