# Account takeover: spotting a hijacked mailbox early > Account takeover starts with a stolen login session, not a stolen password. How Irish SMBs spot a hijacked mailbox early and shut it down in the first hour. *Source: https://panoptic.ie/blog/account-takeover-spotting-a-hijacked-mailbox-early* # Account takeover: spotting a hijacked mailbox early Attackers now phish the login session rather than the password, so an approved MFA prompt no longer settles the question. Here are the signs of a hijacked mailbox, and the order of work when you find one. David Griffith · 26 August 2026 ![Two black USB security keys and stacked documents labeled Supplier Remittance Advice on a white surface.](https://panoptic.ie/_astro/blog_account_takeover_spotting_a_hijacked_mailbox_early_b5c40fb4cf_1S9gqO.jpg) In short Account takeover means an attacker is signed in as one of your staff, reading mail and answering it. Modern phishing kits capture the login session itself, so an approved MFA prompt no longer proves the login page was real. Watch for inbox rules nobody created, mail missing from folders, and sign-ins from places nobody visited. If you suspect it, revoke the active sessions first, then reset the password. Phishing kits now aim at the live login session rather than the password. Once an attacker holds that session, your mailbox answers to them as if they were the person who owns it. Account takeover is quiet, it survives a password reset done in the wrong order, and the first sign is often a supplier asking why your bank details changed. ## Why the MFA prompt did not stop it The pattern we see most often is an adversary-in-the-middle page. Someone clicks a link, lands on a sign-in page that looks correct, and types their password. That page relays everything to the real Microsoft sign-in behind the scenes. The MFA prompt arrives on their phone, they approve it, and the login succeeds for both of them. The attacker copies the session cookie issued at the end, and from that point they are inside the account without needing the password or a second factor again. This is why "we have MFA" no longer closes the conversation. App-based MFA proves that someone answered a prompt. It does not prove the page in front of them belonged to Microsoft. AI has changed the front end of this. Generative tools strip out the spelling and grammar tells your staff were trained to look for, copy the tone of your own suppliers, and produce a clean clone of a login page in minutes. The safe habit now is to judge the request rather than the writing. ## What a hijacked mailbox looks like from the outside Account takeover rarely announces itself. The attacker wants to read for a few weeks before acting, so they hide the evidence as they go. Signs worth taking seriously: - An inbox rule nobody created, usually moving mail containing words like invoice, payment, bank or remittance into Archive, RSS Feeds or Deleted Items. - Mail a colleague says they sent that the recipient never received, or a reply referring to a message that is not in their sent items. - Sign-in alerts from a country nobody was in, or two sign-ins from far apart within the same hour. - A client or supplier mentioning a change of bank details that nobody in your business authorised. - Messages marked as read before anyone opened them, or gone from a folder and sitting in Deleted Items. One of those is worth ten minutes. Two together is an incident. ## The controls that close the common routes Four changes, in the order we would make them. 1. **Move privileged accounts to phishing-resistant MFA.** Passkeys and FIDO2 security keys tie the login to the real site, so a relay page cannot complete it. [The FIDO Alliance](https://fidoalliance.org/passkeys/) explains how that binding works. Start with finance, directors, and anyone holding administrative rights. 2. **Use conditional access to limit where a session is valid.** Blocking legacy authentication protocols, requiring a managed device for administrative work, and shortening session lifetime on risky sign-ins all reduce what a stolen cookie is worth. Which of these you can apply depends on the Entra ID plan behind your licences, so confirm that before you build a plan around it. 3. **Block automatic forwarding to external addresses at tenant level.** Auto-forwarding is how an attacker keeps reading after you think you have locked them out, and few businesses have a genuine need for it. 4. **Alert on new inbox rules and on impossible-travel sign-ins.** Rule creation is the earliest reliable signal in most takeovers, and it fires well before any money moves. None of this can be reconstructed afterwards unless audit logging is switched on and retained. We covered the wider tenant settings in [your Microsoft 365 and cloud setup](https://panoptic.ie/blog/microsoft-365-cloud-security-review). ## The first hour, in order Order matters here. A password reset on its own does not end an active session, so the attacker keeps working while you think the problem is closed. 1. Revoke the account's active sessions and refresh tokens. 2. Reset the password. 3. Re-register MFA from scratch, because attackers often add a method of their own. 4. Check inbox rules, forwarding addresses, delegate access and connected applications, and remove anything nobody authorised. 5. Pull the sign-in and mailbox audit logs, and establish what was read and what was sent. 6. Tell finance and accounts payable the same day, and warn anyone who received mail from that account during the window. 7. Assess whether personal data was exposed. [Article 33 of GDPR](https://gdpr-info.eu/art-33-gdpr/) requires notification to the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of a breach. Write those seven steps down before you need them. Nobody composes a good plan at half past four on the day it happens. ## Money moves at the end of this Account takeover is a means. The end is usually a payment. An attacker who has read a mailbox for three weeks knows your suppliers, your invoice format and who signs off what, so the fake request lands at the moment a real one was expected. FraudSMART, run by the Banking and Payments Federation Ireland, reported €18.9 million lost by Irish SMEs to email-related scams over a two-year period, in [figures published in March 2026](https://bpfi.ie/almost-e19-million-lost-by-smes-to-email-related-scams-over-the-past-two-years-fraudsmart/), with average losses of more than €22,000 per incident. The control that stops the payment is procedural: verify any change of bank details by phone, on a number you already hold, before anyone acts on it. We set that out in [the invoice scam Irish SMEs miss](https://panoptic.ie/blog/business-email-compromise-invoice-scam-irish-smes-miss). ## Where to start this week Pick one account: the finance mailbox, or whichever address your suppliers write to. Check it for forwarding rules and unfamiliar sign-ins, then ask whether anyone in the business would be told if a new rule appeared on it tomorrow. That one check tells you how much of this you already have. Firms in [financial services](https://panoptic.ie/industries/financial-services) and [accountancy](https://panoptic.ie/industries/accountants-solicitors) carry more weight here, because a hijacked mailbox in those trades reaches client money and client records at the same time. If you want the identity side of your tenant reviewed, that work sits inside our [managed IT](https://panoptic.ie/services/managed-it) service. [Get in touch](https://panoptic.ie/contact) and we will start with the accounts that would hurt most. What is account takeover? Account takeover is when an attacker gains access to a legitimate business account, usually email, and uses it as the real user. They read mail, learn how your business pays its suppliers, and send messages from the genuine address. Because the mail comes from a real account, spam filters and recipients have very little to work with. Can attackers get past multi-factor authentication? Yes, when the MFA method is a code or an approval prompt. A relay page shows the real sign-in behind a fake one, the user approves the prompt, and the attacker captures the session cookie that is issued afterwards. Passkeys and FIDO2 security keys resist this, because they check the address of the site before completing the login. How do I know if my Microsoft 365 mailbox has been compromised? Look for inbox rules nobody created, especially ones filing invoice or payment mail out of sight. Check forwarding addresses, delegate access and connected apps. Review sign-in logs for locations and times that do not match your team. Replies referring to messages you never sent are a strong signal, as is a supplier mentioning a bank change nobody authorised. What should I do first if an account has been taken over? Revoke the account's active sessions before you reset the password, because a reset alone leaves an existing session working. Then reset the password, re-register MFA, and remove any rules, forwarding, delegates or apps you did not authorise. Tell finance the same day, and check whether personal data was exposed so you can meet your GDPR reporting duty. [All field notes](https://panoptic.ie/blog) ## Start with a free IT review. You'll get a clear picture of where you're exposed today, and what it looks like to have your whole IT covered as one managed system. No obligation. [Talk to us ](https://panoptic.ie/contact)[See how we onboard](https://panoptic.ie/how-we-onboard)