The Perfect Context
There was nothing unusual about the email. At least, that was how it looked to him. Cybercrime: Malice in Everyday Life — Part 2 You don't have to be someone special to be targeted. Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life. Checks Before the Long…
The email that Corey received appeared ordinary, at least from his perspective. The cybercrime report, "Malice in Everyday Life — Part 2," explained that everyone, not just those with special skills, could become a target. The report traced how these threats gradually infiltrate daily life and their consequences eventually manifest.
On a Friday, just before a long weekend, Corey, who managed administrative tasks at a small logistics firm, was verifying an email from a business associate. The email contained shipment tracking numbers, handover statuses, and invoice amounts. As the end of the month approached, there was more to review. Corey was cross-checking shipping records while navigating through various email threads.
Shortly after noon, he was notified that a shared file had been updated. The sender's name resembled one he commonly dealt with at the partner company. The message referenced ongoing work. Corey clicked the link, leading to a login page for their company's cloud service. He entered his email address, password, and completed the multi-factor authentication.
After a brief delay, he regained access to his email inbox, which seemed normal. However, unbeknownst to him, someone else had accessed his account in the meantime. The attackers had gained not only his email address and password but also the session cookie, a temporary pass stored in the browser after authentication. This allowed them to access the service as Corey, a technique known as Adversary-in-the-Middle (AiTM).
The next day, the partner company called Corey to confirm a change in the bank account for payment. Corey, unaware of the situation, replied, instructing the transfer to a different account with the correct account details. However, the attackers had created a rule that automatically moved incoming messages to another folder, preventing Corey from noticing the partner's inquiry.
They had thoroughly examined Corey's emails, relationships, and current invoices to identify a potential target for money transfer. Using Corey's name and email account, they attempted to deceive the partner company. The company revoked the active sessions and changed the password, contacted the business partners involved, and Corey continued to find messages he couldn't recall sending.
The report highlighted that attacks like this had been documented, with Microsoft revealing a large-scale campaign in July 2022 that used AiTM phishing to target over 10,000 organizations since September 2021.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
