Microsoft 365 Phishing Hack: How to Spot It and Protect Your Business

The email arrived on a Tuesday, the busiest morning of the week, which is not a coincidence. It said her Microsoft 365 password would expire in twelve hours and she needed to re-verify to keep access to her mail. The logo was right. The blue button was right. The login page it opened looked exactly like the one she used every single day.

She typed her password. The page blinked and showed her real inbox, so she forgot about it and got on with her morning.

For the next nine days, a stranger read every message in the company's finance mailbox. He learned who paid whom, what an invoice from them looked like, and the name of the supplier the company was about to wire forty thousand dollars to. On day ten, the supplier's bank details quietly changed in an email that came from inside the company. The money left. Nobody noticed until the real supplier called to ask where their payment was.

No firewall was breached. No password was cracked. One person clicked one link on a busy morning. This is how most businesses get hit now, and Microsoft 365 is the favorite hunting ground because almost everyone is on it.

This is not a rare story. In IBM's 2025 Cost of a Data Breach Report, phishing was the single most common way attackers got in, behind 16 percent of all breaches, and a phishing breach cost organizations 4.8 million dollars on average. The global average breach now costs 4.44 million dollars. Those numbers are why one careless click matters so much: the click is free, the cleanup is not.

There are a dozen names for what happened to her. Security people call it phishing. Most people call it getting hacked, or a Microsoft scam email, or the fake invoice that cost the company real money. The label does not matter. The pattern does, and once you have seen it once you will spot it every time.

What is Microsoft 365 phishing, and why do people call it a hack or scam?

Microsoft 365 phishing is an attack that pretends to be Microsoft so you hand over your login. You will also see it called a Microsoft 365 hack, an Office 365 scam, or just a scam email, and they all describe the same trick. The bait is a message dressed up as a security alert, a password expiry, a shared file, or a missed voicemail. The goal is always the same. Get you to type your work email and password into a page the attacker controls.

It works for a simple reason. Your Microsoft 365 login is not one key. It is the master key. The same password opens your email, your files in OneDrive and SharePoint, your Teams chats, and often your calendar and contacts. Steal it once and the attacker does not break into one room. They walk through the whole building, and they do it wearing your name.

The uncomfortable upgrade in the last two years is that stealing the password is no longer even the hard part. Modern phishing kits sit in the middle, between you and the real Microsoft login. You type your password, it passes through to Microsoft, and Microsoft sends a real multi-factor prompt to your phone. You approve it, because as far as you can tell the login is real. The kit catches the session in the middle and walks straight past the multi-factor check. This is why "we have MFA, we are fine" is no longer true on its own.

How to spot a Microsoft 365 scam or phishing email

You do not need to be technical to catch most of these. You need to slow down for ten seconds and check a short list. Here is what gives them away.

• The sender domain is wrong. Real Microsoft mail comes from microsoft.com or a tenant ending in onmicrosoft.com. Phishing comes from a lookalike like micros0ft-support.com or a random address. Read it letter by letter.
• It manufactures urgency. "Your account will be deleted in 24 hours." "Password expires today." Real systems rarely threaten you on a clock. Fear is the whole tactic.
• The link does not go to Microsoft. Hover over the button without clicking. The real login is at login.microsoftonline.com. If the address would say anything else, it is fake.
• It asks you to re-verify or reactivate. Microsoft does not ask you to confirm your password through an email link. Ever.
• The greeting is generic. "Dear user" or "Dear account holder" from a company that knows your name is a red flag.
• A fake invoice or shared document. The scam email that looks like an unpaid invoice or a shared file is one of the most common, because money and curiosity both make people click before they think.
• An MFA prompt you did not trigger. If your phone buzzes asking you to approve a login you never started, someone has your password right now and is standing at the door. Deny it and change your password.

A good habit beats a good eye. If an email wants your Microsoft password, do not use its link. Open a new tab, type the Microsoft address yourself, and log in there. The attacker's trap only works if you walk through their door instead of your own.

How to know if your Microsoft 365 is hacked

If you are reading this with a knot in your stomach because you think you already clicked, here is how to check. These are the fingerprints attackers leave behind in Microsoft 365.

• Strange inbox rules. This is the classic one. The attacker creates a hidden rule that auto-forwards your mail to an outside address, or moves anything containing "invoice" or "payment" straight to a folder you never open. Check your rules in Outlook settings now.
• Sign-ins from places you have never been. Microsoft 365 logs every login with a location. A sign-in from another country at three in the morning is not you.
• Sent mail you did not send. Look in your Sent folder and your Deleted folder. Attackers often delete the evidence, so an empty patch can itself be the clue.
• Your MFA method changed. If a new phone number or app was added to your security settings, someone is trying to lock you out for good.
• Colleagues reply to emails you never wrote. Often the first person to notice a hack is the customer or coworker who answers a message you have no memory of sending.

If any of these are true, treat it as real. Change your password from a device you trust, sign out of all sessions, remove any rules and MFA methods you do not recognise, and tell whoever runs your IT immediately. Speed matters more than certainty here. The cost of overreacting is an hour. The cost of underreacting is the forty thousand dollars.

How to actually protect your business

Spotting bad emails is defense by reflex, and reflexes fail on busy Tuesdays. Real protection is built into the system so that one tired click does not end with money leaving the building. None of this is exotic. It is just rarely set up properly.

• Use phishing-resistant MFA. Text-message codes and simple approve prompts can be stolen in the middle, as we saw. Microsoft's 2025 Digital Defense Report traced 80 percent of MFA-bypass breaches to exactly this trick, session-token theft through adversary-in-the-middle kits. Passkeys and hardware-backed sign-in (the FIDO2 standard) cannot be relayed this way, because they are tied to the real site. This single change defeats most of the attacks above.
• Train people like it is a fire drill, not a lecture. Security awareness training works when it is short, regular, and free of blame. People stop clicking when they have safely seen the trick before, not when they are shamed after.
• Run phishing simulations. Send your own team safe, fake phishing emails on a schedule. Microsoft's own tool for this is called attack simulation training, and it answers the only question that matters: would your people click before a real attacker makes them?
• Turn off the old doors. Disable legacy authentication, which skips MFA entirely, and use conditional access so logins from strange countries or unmanaged devices get blocked or challenged.
• Get an audit. An outside review of your Microsoft 365 setup usually finds three or four open windows nobody knew were open. Closing them costs far less than one fraudulent wire.

Why African businesses are now squarely in the crosshairs

Here is the part the global security headlines skip. Attackers follow two things, the money and the soft targets, and right now a lot of fast-growing African businesses are both.

The digitisation has been remarkable. Companies that ran on paper five years ago now run on Microsoft 365, cloud accounting, and mobile money. That is real progress. But the security maturity underneath has not caught up at the same speed, and attackers know it. They are not only chasing banks in New York. They are chasing the mid-sized firm in Abidjan or Lagos that just moved its whole operation online and set up MFA with text messages because that was the default.

The answer is not fear, and it is not spending like a multinational. It is the same engineering discipline we bring to everything. Find the open windows, close the ones that matter most first, and build the habit of testing instead of trusting. A business does not need to be unbreakable. It needs to be a harder target than the company next door, because attackers, like water, take the easiest path down.

Start with the one change that matters most

If you do nothing else this week, do this. Turn on phishing-resistant multi-factor authentication for everyone, beginning with the people who touch money and the people with admin rights. Passkeys and hardware keys are no longer expensive or awkward, and they close the exact gap that the attacker-in-the-middle kits walk through. Then turn off legacy authentication, because it is the unlocked side door that quietly cancels every other lock you own.

These two settings take an afternoon. They stop the large majority of the attacks in this article, and they cost nothing but the time to switch them on. Everything else, the training, the simulations, the audit, makes that foundation stronger. But the foundation is two switches, and most businesses have never flipped them. The company that lost forty thousand dollars had neither one turned on. The fix would have cost them a single afternoon.

Frequently asked questions

How do I know if my Microsoft 365 account has been hacked? Check for inbox rules you did not create, sign-ins from unfamiliar locations in your account's recent activity, sent or deleted mail you do not recognise, and any change to your MFA settings. Any one of these means treat it as compromised and reset your password immediately.

Can phishing get past multi-factor authentication? Yes. Attacker-in-the-middle phishing kits can steal your active session and skip a basic MFA prompt. This is why phishing-resistant MFA, like passkeys or hardware keys, matters. It is the version that cannot be relayed.

My Microsoft account was hacked and the email or password was changed. What do I do? Act immediately. Use Microsoft's account recovery to get back in, then change the password, remove any phone numbers or MFA methods you do not recognise, check for forwarding rules, and review recent sign-ins. If it is a work account, tell your IT or security contact at once so they can check whether other accounts were touched.

I keep getting Microsoft 365 scam emails that look like invoices. Are they dangerous? Yes. The fake-invoice email is one of the most common Microsoft 365 scams because it mixes a believable reason with urgency about money. Do not click the link or open the attachment. If it claims to be from a supplier you know, confirm by phone using a number you already have, not one in the email.

I got an Office 365 spam email that looks like it came from my own address. Am I hacked? Not always, but check. Attackers often spoof your address without being inside your account. But if you also see strange sign-ins, new inbox rules, or sent mail you did not write, treat it as a real Office 365 hack and reset your password right away.

I think I just clicked a phishing link. What do I do right now? Do not panic, but move fast. Change your Microsoft 365 password from a device you trust, sign out of all active sessions, remove any unfamiliar inbox rules or MFA methods, and tell whoever runs your IT. If finance data was exposed, warn your finance team to verify any payment changes by phone.

Sources

• IBM, Cost of a Data Breach Report 2025: phishing as the top initial attack vector (16 percent of breaches), the 4.8 million dollar average cost of a phishing breach, and the 4.44 million dollar global average.
• Microsoft, Digital Defense Report 2025: 80 percent of MFA-bypass breaches traced to session-token theft through adversary-in-the-middle kits.