Business Email Compromise Attack Hijacks Session Token to Steal Vendor Payments

Cybersecurity firm TrendAI reported on an email compromise (BEC) scheme that involved the hijacking of a session token to steal vendor payments in August 2024. The attackers began by targeting a finance user with a spear-phishing email that appeared to be concerning a denied PTO request. The email contained personalized information, including the target's name, job title, and organization, and prompted the recipient to click a button labeled "View Conflicting PTO Dates."

Once the victim clicked the malicious link, the attackers used an Adversary-in-the-Middle phishing page to bypass multi-factor authentication and hijacked the victim's live Microsoft 365 session token. With this control, the criminals were able to conceal the fraudulent activity for 30 days by setting up three malicious inbox rules to auto-archive and mark as read incoming vendor and internal collection emails.

During this time, the attackers impersonated vendors and rerouted the company's payments to bank accounts under their control. Cybersecurity experts emphasized that this BEC campaign highlighted the modern enterprise perimeter's vulnerabilities, where trust and identity are the primary battlegrounds. The sophistication of these attacks necessitates a reevaluation of security measures, as highlighted in a PYMNTS report from December 2024.

This report noted that 83% of U.S. companies had been targeted by highly sophisticated cyber fraud, with business email compromise schemes being the most prevalent.