--- title: "Thwarting Financial Fraud" url: https://daily.dev/posts/thwarting-financial-fraud-exezymqij source_url: https://www.huntress.com/blog/thwarting-financial-fraud-shutting-down-hackers-in-microsoft-365 type: article source: "Huntress Blog" published: 2026-05-31T07:43:14.078Z updated: 2026-05-31T08:16:43.851Z tags: ["security", "microsoft"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Thwarting Financial Fraud **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 5 min read · 0 upvotes · 0 comments ## Summary Huntress details a real-world business email compromise (BEC) attack caught during beta testing of their MDR for Microsoft 365 product. A threat actor logged in from a Nigerian IP address, created obfuscated inbox rules with keyboard-walk names (e.g., 'jkhjg', 'm,bvc') to silently move emails to the rarely-visited Conversation History folder, and set up forwarding rules targeting finance and operations staff at multiple companies. The goal was to intercept vendor invoices and redirect payments to attacker-controlled accounts. Key detection signals include inbox rules routing mail to the Conversation History folder and short nonsensical rule names paired with Mark as Read actions. The post includes IoCs and MITRE ATT&CK TTPs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Lessons from the Underground: How to Combat Business Email Compromise](https://daily.dev/posts/lessons-from-the-underground-how-to-combat-business-email-compromise-0zqlz8jcq) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/thwarting-financial-fraud-exezymqij)