1. 1. Identify the compromised account How was the compromise discovered? Suspicious email reported by a recipient, impossible travel alert, forwarding rule to unknown external address, or a vendor/partner flagging unusual requests. Pull Azure AD / Entra ID sign-in logs for the account immediately. Azure AD sign-in logs · M365 Unified Audit Log
2. 2. Revoke all sessions and reset credentials Password reset is not enough. Revoke all active sessions and refresh tokens (Revoke-AzureADUserAllRefreshToken or Entra ID portal). If the attacker has an active OAuth token, it survives a password reset. Disable the account temporarily if the scope is unclear. Azure AD: Revoke-AzureADUserAllRefreshToken · Conditional Access: require re-auth
3. 3. Check and remove mailbox rules IMMEDIATELY This is the most time-sensitive technical step. Forwarding rules exfiltrate every new email in real-time. Check for: rules forwarding to external addresses, rules deleting messages matching keywords ("invoice," "payment," "wire," "ACH," "transfer"), rules moving messages to RSS or hidden folders, and rules created via PowerShell/EWS/Graph API rather than the web UI. Remove all suspicious rules before doing anything else. Get-InboxRule -Mailbox <user> | FL Name,Description,Enabled,ForwardTo,ForwardAsAttachmentTo,DeleteMessage,MoveToFolder
4. 4. Check for OAuth app consent grants Malicious OAuth apps provide persistent mailbox access that survives password resets, MFA changes, and session revocation. Check Azure AD Enterprise Applications for recent consent grants, especially apps requesting Mail.Read, Mail.Send, Mail.ReadWrite, or full mailbox scope. One documented case created 17,000 multitenant OAuth apps and sent 927,000 phishing emails from compromised accounts. Azure AD: Enterprise Applications · Audit logs: "Consent to application"

1. 5. Build the authentication timeline Map every sign-in for the compromised account: timestamps, source IPs, user agents, MFA results, and conditional access outcomes. Identify the first unauthorized access (the attacker's entry point) and every session since. Look for: logins from VPS/hosting providers, logins from countries the user has never visited, logins with legacy authentication protocols that bypass MFA, and adversary-in-the-middle sessions (AiTM). Azure AD sign-in logs · Compromised Credentials playbook
2. 6. Determine what the attacker read Pull the M365 Unified Audit Log for MailItemsAccessed events. These show which emails the attacker opened. Focus on: emails containing financial information (invoices, payment details, bank accounts), sensitive attachments (contracts, PII, credentials), and conversation threads with vendors or partners that the attacker could insert themselves into. Search-UnifiedAuditLog -Operations MailItemsAccessed -UserIds <user>
3. 7. Check for outbound phishing from the compromised account Compromised accounts are immediately weaponized for lateral phishing. Messages from a trusted internal sender bypass every inbound email filter. Search sent items and message trace logs for: mass outbound emails, emails with credential harvesting links, device code phishing payloads, and emails to the victim's contact list or organizational directory. Storm-2372 used compromised internal accounts specifically for device code phishing distribution. M365 message trace · Search-UnifiedAuditLog -Operations Send
4. 8. Check for financial fraud in progress Search the mailbox and sent items for: payment redirect requests ("our bank details have changed"), invoice modifications with altered account numbers, wire transfer instructions, payroll diversion requests ("please update my direct deposit"), and gift card requests from "executives." Check whether any recipients have already acted on these messages. Contact finance and accounts payable directly.
5. 9. Check for MFA manipulation Did the attacker register new MFA methods on the compromised account? A new authenticator app, a new phone number, or a FIDO key registered during the compromise window gives the attacker a persistent authentication path that survives password reset. Audit the account's MFA registration history and remove any methods added during the compromise. Azure AD: Authentication methods activity · Audit log: "User registered security info"
6. 10. Check for privilege escalation from the mailbox Did the attacker use the compromised email to reset passwords on other accounts ("forgot password" flows), approve MFA requests for other users, or request IT access changes? Email-based password resets on downstream accounts turn one compromised mailbox into many compromised accounts. Check password reset audit logs for resets initiated from the compromised account's sessions. Azure AD audit log: "Reset password" · Self-service password reset logs

1. 11. Determine whether this is isolated or campaign-wide Was this one account compromised via targeted phishing, or is this part of a mass credential harvesting campaign? Check: did other users receive the same phishing email? Are other accounts showing similar sign-in anomalies? Did the compromised account send lateral phishing that other users clicked? If the entry was AiTM/phishing-as-a-service (Tycoon 2FA, Evilginx), assume the kit targeted multiple users. Email gateway: search for the phishing lure across all recipients
2. 12. Notify affected parties If fraudulent emails were sent to external vendors, partners, or clients: notify them directly (by phone, not email) that the account was compromised and to disregard any recent payment or banking changes. If PII was accessed, assess regulatory notification obligations (HIPAA, GDPR, state breach notification laws). One documented healthcare BEC exposed 882,000 individuals' PII through email access alone.
3. 13. Harden against recurrence Deploy phishing-resistant MFA (FIDO2 hardware keys or platform passkeys) since they cannot be phished by AiTM proxies. Enforce OAuth consent governance requiring admin approval for apps requesting mail scopes. Enable mailbox rule creation alerting. Disable legacy authentication protocols. Implement conditional access policies for risky sign-ins. These are not optional hardening: they are the controls that prevent BEC from recurring.

ClickFix / fake CAPTCHA (+563% in 2025). Victim visits a compromised or attacker-controlled site and sees a fake CAPTCHA or "verify you are human" prompt. Clicking it copies a malicious PowerShell command to the clipboard and instructs the user to paste it into a Run dialog. The command downloads credential stealers or establishes a session hijack. This bypasses email gateway filtering entirely because the delivery is a website, not an email attachment. CrowdStrike 2026 GTR flagged this as the fastest-growing social engineering technique.

Vishing (+442% between H1-H2 2024, now #2 initial access vector). Voice phishing calls impersonating IT help desks, vendors, or executives. Scattered Spider industrialized this: call the help desk, request a password reset, defeat MFA, pivot to identity infrastructure. AI-generated voice cloning makes impersonation of specific individuals trivial. Mandiant M-Trends 2026 ranked vishing as the #2 initial infection vector, present in 11% of investigations. CrowdStrike confirmed H1 2025 vishing volume already exceeded all of 2024.

Device code phishing. Attacker sends the victim a legitimate Microsoft device authorization code and instructions to enter it at microsoft.com/devicelogin. The victim authenticates at Microsoft's real login page, granting the attacker a valid OAuth token without ever seeing a fake login page. Phishing-resistant MFA (FIDO2, passkeys) does not block this because the victim authenticates at the real identity provider.

CEO fraud / executive impersonation. Attacker spoofs or compromises an executive's email and requests urgent wire transfers or gift card purchases from finance staff. Often combined with deepfake voice calls (cloning from public earnings call audio) for phone-based verification bypass.

Vendor email compromise (VEC). Attacker compromises a vendor's mailbox and inserts themselves into an active invoice thread. They send a legitimate-looking email with updated bank details. The victim pays the next invoice to the attacker's account. Harder to detect because the email genuinely comes from the vendor's domain.

Payroll diversion. Attacker impersonates an employee and requests a direct deposit change with HR/payroll. Low dollar amount per event but high volume. Often targets large organizations where HR doesn't personally know every employee.

Lateral phishing. Attacker uses the compromised mailbox to send phishing to the victim's contacts and colleagues. Messages from a trusted internal sender bypass all inbound email security. The goal is to compromise additional accounts or harvest credentials at scale.

Most BEC is operated by financially motivated criminal groups, not nation-states. However, state actors increasingly use BEC techniques for espionage access. Storm-2372 (Russia-aligned) used compromised internal accounts for device code phishing distribution across organizations. APT28 modifies Exchange mailbox permissions for persistent email access as part of espionage operations. Scattered Spider (UNC3944) combines help desk social engineering with mailbox takeover for financial fraud.

Compromised Credentials (BEC starts with credential theft in most cases)
Living-off-the-Land Activity (post-BEC activity is entirely credential-based, no malware)
APT28 (Exchange mailbox permission modification for espionage)