How Hackers Get Into Small Business Microsoft 365 Accounts

Credential stuffing and password reuse

Attackers buy or scrape lists of email and password combinations leaked from unrelated breaches, then run them automatically against Microsoft 365 sign-in pages, betting that some employees reused a password. This works because it always finds someone.

Warning signs include sign-in attempts from unfamiliar countries in the Entra sign-in logs, or a spike of failed logins followed by one success. The fix is a password manager so nobody reuses passwords, paired with MFA so a leaked password alone is not enough.

Phishing and adversary-in-the-middle token theft

Modern phishing kits do not just capture a password, they sit between the victim and the real Microsoft login page, capturing the session token after MFA is completed. This defeats basic MFA because the attacker gets a valid, already-authenticated session, not just a password.

Warning signs include a login page URL that looks close to but not exactly office.com or login.microsoftonline.com, and an unexpected sign-in alert shortly after clicking an email link. The strongest defence is phishing-resistant authentication, conditional access policies that restrict sign-ins to managed or compliant devices, and layered email security filtering that stops the phishing email before anyone clicks it. See how to secure business email from phishing for more detail.

MFA fatigue and push bombing

Once an attacker has a valid password, they can trigger repeated MFA push notifications hoping the employee eventually taps approve just to make the notifications stop. This works surprisingly often, especially late at night or during a busy workday.

Warning signs include an employee mentioning several unexpected authentication prompts. The fix is switching from simple approve/deny push notifications to number matching, and training staff that repeated unexpected prompts should be reported immediately, never approved.

Legacy authentication protocols

Older protocols such as POP, IMAP, and legacy SMTP authentication were built before MFA existed and can sometimes be used to bypass it entirely if left enabled on a tenant. Attackers specifically look for tenants that still allow these protocols.

There are usually no visible warning signs to end users, which is exactly the risk. This is fixed at the tenant level by disabling legacy authentication through conditional access, something covered in our Microsoft 365 security best practices article.

OAuth consent phishing

Instead of stealing a password, attackers send a link to what looks like a normal Microsoft sign-in and consent screen for a third-party app. If the employee clicks "Accept," they grant a malicious application ongoing access to their mailbox and files, no password needed at all.

Warning signs include an unfamiliar app name appearing in the consent prompt, or requests for permissions that make no sense for the app in question, such as full mailbox access for a simple calendar tool. Restricting user consent for third-party apps at the tenant level and reviewing existing app permissions periodically closes this path.

Compromised third-party apps and integrations

Businesses connect dozens of small apps to Microsoft 365 over time, CRM add-ins, scheduling tools, marketing platforms. If one of those vendors is breached, the connected app's access token can be used against your tenant even though your own staff did nothing wrong.

There are usually no direct warning signs until the vendor discloses a breach. Periodically auditing connected apps and removing ones nobody uses anymore limits this exposure.

Insider mistakes and account sharing

Shared logins, passwords written on sticky notes, or a departing employee's account that was never disabled all create openings that have nothing to do with sophisticated hacking. This is one of the most avoidable categories because it is entirely process, not technology.

A documented offboarding checklist and a policy against shared accounts closes most of this gap without spending anything on tools.

Attack path summary

If you think an account is already compromised

Act quickly rather than perfectly. Disable the account's sign-in, revoke active sessions, reset the password, and check mailbox rules for anything forwarding mail externally, since this is a common way attackers stay hidden after the initial compromise. Our guide on what to do if your business has been hacked covers the fuller response process.

Sources and further reading

• Microsoft Learn: Common conditional access policies
• Canadian Centre for Cyber Security

Frequently asked questions