🇿🇦 English, 14 October 2026, spear phishing
Attackers Compromise Microsoft 365 Environment to Steal $1.5m
Attackers use Outlook rules to intercept and alter emails, leading to a $1.5m crypto-currency investment loss.
The attackers compromised Microsoft 365, quietly taking control of the conversation and letting the firm authorise the payment itself.
Small changes to email addresses were difficult to notice, particularly when the sender’s display name appeared more prominently than the actual address.
The firm believed it was continuing a legitimate conversation with its investment counterparty, and the attackers confirmed receipt of a test crypto-currency transfer before instructing the firm to transfer the remainder of the investment.