Many business owners tell us, "We have two-step login, so we're safe." It is one of the best protections you can turn on, and if you have it, good. But a report published on October 23 is a useful reminder of what it doesn't cover. Security researchers described Microsoft 365 accounts at 79 organizations being taken over without the attackers ever needing a password.
What happened, in plain terms
When you sign in to Microsoft 365, you type your password and approve a text code or app prompt. After that, your browser holds on to a kind of digital "keycard" that says you've already signed in. That is why you don't have to sign in again every time you open Outlook or a new tab.
In these attacks, the hackers didn't guess or steal passwords. They stole the keycard. Anyone holding it can walk into the account as you, in their own browser, until the keycard expires or is cancelled. Attacks like this usually start with a convincing fake sign-in page or with malicious software on a computer.
Why two-step login helps, but isn't a magic shield
Two-step login (also called multi-factor authentication, or MFA) protects the moment you sign in. It stops someone who has your password from getting in, and it blocks the vast majority of everyday account attacks. Keep it on.
What it can't do is protect a session that has already been approved. Once the keycard exists, the text code has done its job. That is why it also matters how long a session lasts, where it can be used from, and whether anyone notices when it's used somewhere strange.
Warning signs
Watch for these, and take them seriously:
- Sign-in alerts you don't expect, especially from a city, country or device you don't recognize.
- Email rules you didn't create, such as rules that forward mail to an outside address, or move or delete messages automatically. Attackers use these to hide their tracks.
- Colleagues or customers getting odd messages from your account, like unexpected invoices, payment changes or "please review this document" links.
Simple protections
A few settings make a stolen keycard much less useful:
- Shorter session lifetimes, so people sign in again on a regular schedule and an old keycard stops working sooner.
- Sign-in rules that block unfamiliar devices or locations. For example, only allow access from company computers, or block countries where nobody on your team works.
- Sign-in alerts that someone actually watches. Microsoft 365 can flag risky sign-ins, but an alert nobody reads protects no one.
Some of these controls are included in Microsoft 365 Business Premium. If you have a different plan, it's worth knowing what you have and what you're missing.
What to do if you suspect a takeover
Changing the password is not enough on its own, because the stolen keycard can keep working. Do both:
- Change the password, and
- Sign out all sessions, so every keycard is cancelled and everyone, including the attacker, has to sign in again.
Then check the mailbox for forwarding rules you didn't create, and warn anyone who may have received suspicious messages from the account.
How we can help
We can review your Microsoft 365 sign-in settings in a short, no-pressure check-up and tell you in plain English where the gaps are. If you think an account has already been taken over, call us right away. Contact us or call (480) 382-3289.
Sources: Microsoft 365 accounts compromised at 79 organizations, no passwords needed (Help Net Security) and Black October: How to Check Microsoft 365 and Your Website After This Week's Attacks (Regroove)