Finance user entered credentials on a fake Microsoft 365 login

First, I escalate this as a P1 critical incident, because a Finance user was phished and a malicious sign-in has already succeeded. The replayed session with no MFA challenge tells me this is adversary-in-the-middle session token theft, not just a stolen password. This social engineering attack impersonated a trusted internal sender.

For containment, I reset password and rotate credentials on the affected account, revoke session tokens and sign out everywhere so the stolen refresh token is invalidated, and disable account access if suspicious activity continues. I isolate the laptop and block the phishing domain and the malicious source IP at the proxy.

Next, for investigation I review the identity provider sign-in log, confirm the source IP, geolocation, and user agent, and audit the mailbox for the attacker-created inbox rule or any auto-forward. I gather indicators of compromise (IOC) and check whether other users were targeted by the same page.

Before remediating, I preserve evidence: I export logs, capture a forensic snapshot of the laptop, and retain the message with its original headers for chain of custody.

Finally, for recovery I restore access once the account is verified clean, enforce MFA through Conditional Access, and run phishing awareness training so a repeat is less likely.

• Attack understanding3/3 · 15.0 / 15
• Asset impact2/3 · 6.7 / 10
• Prioritization2/2 · 10.0 / 10
• Containment5/5 · 20.0 / 20
• Investigation4/4 · 15.0 / 15
• Recovery3/3 · 10.0 / 10
• Evidence preservation3/3 · 10.0 / 10
• Clarity & structure2/2 · 10.0 / 10

None detected in your response.