Not by “hacking Microsoft”.
Almost always by logging in.
The uncomfortable truth
Microsoft 365 is secure.
But it relies on:
- Logins
- Configurations
- Users
…and that’s where gaps appear.
Method 1: phishing
Still the most common.
An email that looks legitimate:
- Microsoft notification
- Supplier message
- Shared document
User clicks → enters credentials → attacker logs in.
Method 2: password reuse
If a password is used elsewhere and leaked:
Attackers try it against Microsoft 365.
If there’s no MFA:
They’re in.
Method 3: password spraying
Trying common passwords across many accounts:
- Spring2026!
- CompanyName123
Low effort. High success rate.
Method 4: MFA gaps
MFA helps.
But:
- Not always enforced everywhere
- Sometimes bypassed (token theft, fatigue attacks)
If it’s inconsistent, it creates openings.
Method 5: legacy protocols
Older authentication methods (like IMAP/POP):
Don’t support MFA properly.
If enabled, they can be abused.
What happens after access
Once in, attackers:
- Read emails
- Monitor conversations
- Set up forwarding rules
- Hide activity
Then:
- Launch invoice fraud
- Request payment changes
- Send internal phishing
Why it’s hard to spot
Because:
- Login looks legitimate
- No malware involved
- Activity appears normal
Unless someone is watching behaviour.
Real-world example (typical pattern)
- Account compromised
- Inbox rules created
- Supplier conversation intercepted
- Bank details changed
- Payment sent
No alarms.
Just a normal-looking email.
What actually reduces the risk
Not just “turning things on”.
But doing it properly:
- MFA everywhere (no exceptions)
- Monitoring login behaviour
- Detecting unusual activity
- Reviewing configurations
- Securing identities
Email security alone isn’t enough
Even good filtering won’t catch everything.
And once someone logs in:
It’s no longer an “email problem”.
It’s an identity problem.
The key shift
Most attacks now start with:
A login, not malware.
If someone logged into your Microsoft 365 tonight:
- Would you know?
- How quickly?
If you’re unsure, that’s exactly where most businesses start – for a no-presure, non-salesy chat, please get in touch.
