Adversary-in-the-middle phishing and session token theft at an accounting firm in tax season, contained and closed off

An accounting firm of about 60 people called us during tax season after a partner saw replies in a client thread that she had never written. The client is not named on this page. This is an illustrative engagement that describes the kind of work our team does; details are composite. Email could not go offline: returns, identity documents and filing deadlines all lived in mailboxes, so the first instruction was to contain the attacker without stopping the firm.

The cause was an adversary-in-the-middle phishing attack. Three staff had followed a link in a message that looked like a document share and signed in on a lookalike page. The page relayed each login to Microsoft in real time, so the staff member passed multi-factor authentication, and the attacker kept the session token that Microsoft issued. With the token the attacker did not need the password or a second code. App-code and text-message sign-in do not stop this pattern.

Containment came first. Our team revoked every session and refresh token for the three accounts, reset the credentials and removed sign-in methods and devices the attacker had registered. Then we searched every mailbox for what attackers leave behind: rules that hid replies, moved messages to obscure folders or forwarded copies to outside addresses. Those rules were removed tenant-wide, and the firm's counsel received a timeline built from sign-in logs, audit events and message trace.

Closing the door took three controls. Conditional Access now requires phishing-resistant sign-in, passkeys or FIDO2 security keys, for partners, staff who handle client documents and administrators, because those methods are bound to the real site and a lookalike page cannot relay them. Token protection ties a session to the device it started on, so a stolen token is far less useful elsewhere. Legacy authentication is blocked, and alerts fire on new inbox rules and external forwarding.

The firm stayed open through the filing deadline, and staff learned from the real message instead of a canned example. Any change to a client's bank or refund details now needs a callback to a known number. This is the work our team does under cybersecurity and email security services; it reduces the chance and the damage of a repeat, and it is not a guarantee.