The Phishing Threat Targeting Microsoft 365 Users Across Central Pennsylvania
Most cyberattacks do not begin with hackers. They begin with an email.
An insurance agency in Lancaster County discovered this firsthand when ransomware locked down their systems mid-week with no warning. The forensic trail led back to a single Microsoft 365 login captured through a phishing email days earlier. In the time between that credential theft and the ransomware deployment, the attacker had read internal emails, identified their most sensitive files, and built a map of the organization from the inside. By the time anyone noticed something was wrong, the damage was already done.
This is not a story about a sophisticated criminal operation. It is a story about a well-crafted email and a business that had not yet built the defenses to stop what came next.
Engineered to Fit Right In
What makes modern phishing emails so effective is not brute force. It is precision. Before a single message is sent, attackers research their targets. Public websites, LinkedIn profiles, and industry directories give them everything they need to craft an email that feels like it belongs in your inbox.
The messages that cause the most damage impersonate Microsoft directly. They arrive carrying the familiar logo, the standard formatting, and a subject line that creates just enough pressure to move someone to action before their instincts catch up:
- Sign-in attempt from an unrecognized device — verify your account now
- You have a pending document awaiting your review in SharePoint
- Your Microsoft 365 license requires immediate renewal to avoid service interruption
- A payment approval is needed before end of day
None of these feels like threats. That is precisely the design.
The Anti-Phishing Working Group (APWG) tracks phishing activity globally, documenting how these campaigns are engineered and continuously refined to stay ahead of filters, awareness training, and detection tools.
The Conditions Criminals Rely On
Falling for a phishing email is not a character flaw. It is a predictable outcome when well-constructed deception meets a busy, distracted workday.
Consider what is actually happening when your team processes email. High volume. Time pressure. Mobile devices where the sender address is abbreviated and links cannot be safely previewed before tapping. An organizational culture that rewards fast responses. Criminals understand all of this and engineer accordingly.
The specific pressures built into phishing messages are deliberate:
- Impersonation of authority shifts trust from the recipient’s own judgment to the apparent sender
- Manufactured urgency removes the pause that would otherwise lead to scrutiny
- Mimicry of routine makes the message blend in with the dozens of legitimate notifications your team already acts on daily
- Cognitive overload means that the more demands on your team’s attention, the less any single message gets examined
Your most capable, highest-volume employees are often the most exposed. Not because they are careless, because they are moving fast through a carefully constructed trap.
From Click to Compromise: What Happens to the Credentials
The phishing link deposits the employee on a Microsoft 365 login page that is visually identical to the real one. The colors, the logo, the layout, it all matches. The employee logs in. Their credentials are captured instantly and silently.
Where businesses get caught off guard is in assuming that multi-factor authentication covers the rest. MFA is a critical control. It is not an impenetrable one. Attackers have developed two widely used techniques to work around it:
- MFA Fatigue (Push Bombing): The attacker generates a stream of authentication push requests. Annoyed and distracted, the employee eventually taps Approve. The attacker walks in.
- Adversary-in-the-Middle (AiTM) Attacks: The phishing site operates as a live proxy, relaying the real Microsoft login in real time. It captures not just credentials but the active session token — a
- valid, already-authenticated credential that bypasses MFA entirely because authentication has already occurred.
What Full Tenant Access Actually Gives a Criminal
The phrase “got into our email” dramatically understates what happens when an attacker captures M365 credentials and reaches admin access. Your Microsoft 365 tenant is the governing environment for your organization’s entire relationship with Microsoft. Owning it means owning far more than one inbox:
- Every email account, calendar, and contact across your entire organization
- All documents stored in SharePoint and OneDrive, including contracts, financials, and client records
- Internal communications across Microsoft Teams
- Third-party applications authenticated through your M365 environment
- Azure Active Directory, where attackers can create new administrator accounts and cut off your legitimate users entirely
The Lancaster County insurance agency had no idea they had company. Their attacker operated undetected long enough to understand the organization completely before the ransomware was deployed. That silent period, the reconnaissance phase, is what makes these incidents so destructive.
The Attack Does Not End with the Credential. It Just Starts There.
Once access is established, the progression is methodical and patient:
- The stolen credential opens the initial door
- The attacker observes, reads, and maps the environment without triggering alerts
- Access is extended laterally to additional accounts and systems
- Valuable data is removed quietly before any disruptive action is taken
- Ransomware is deployed when the attacker is satisfied they have maximized their position
Speed is not the goal. Thoroughness is. Every additional day of undetected access increases the attacker’s leverage and compounds the eventual damage.
What Your Team Needs to Know and Practice
These five steps help your team keep safe from phishing attacks.
- Read the actual sender domain in the email header rather than accepting the display name at face value
- On desktop, hover over links to verify their true destination before clicking. On mobile, navigate directly to the application in a fresh browser session rather than following any embedded link
- When an email asks you to log in to anything, open that service directly rather than clicking through the message
- Any request that feels urgent or unusual warrants a quick out-of-band verification, a call, a text, a walk down the hall
- Suspicious emails belong in a report to IT, not the recycle bin
Monthly phishing simulations are more effective than annual training alone because they test real behavior under real conditions, not just knowledge retention from a slide deck.
Technology That Works Means Security That Holds, The TCW Approach
At TCW Computer Systems, Inc., we believe security is not a product you buy once. It is a posture you build and maintain. Our layered approach to protecting Microsoft 365 environments reflects that, combining proactive tools, continuous monitoring, and the human training that ties it all together.
- PHIN Monthly Phishing Simulations: We run ongoing simulated phishing campaigns through PHIN so your team is regularly tested against real-world attack scenarios, not just trained once and forgotten.
- Microsoft 365 Security Hardening: Conditional Access policies, phishing-resistant MFA configuration, and Defender tuning close the gaps that default M365 settings leave exposed in nearly every environment we assess.
- Huntress EDR/MDR: Our partnership with Huntress delivers 24/7 managed endpoint detection and response, with a dedicated security operations team actively hunting threats across your environment around the clock, not just alerting on them.
- ThreatLocker Application Control: ThreatLocker enforces a zero-trust application allowlisting approach, ensuring that only approved software can execute on your systems. Ransomware cannot run what it cannot install.
- 24/7 SOC Monitoring: Continuous security operations center coverage means threats are identified and acted on at any hour, not discovered the morning after.
- TCW DataSafe Backup and Recovery: In the event of a breach, clean, verified backups mean recovery is measured in hours rather than weeks. We monitor backup integrity daily, so you are never relying on a backup you have not actually tested.
Technology That Works. Security That Proves It.
The insurance agency that came to us after their incident is operational again. But the weeks of disruption, the client notification requirements, the forensic costs, and the reputational exposure added up to a number that dwarfs what a proper security posture would have cost.
One email. One click. One credential. That is all these attacks require to get started.
TCW has been protecting Central Pennsylvania businesses for over three decades because we believe technology should be a source of confidence, not anxiety. If you want to know exactly how your Microsoft 365 environment holds up against the attacks targeting businesses in your region right now, we are ready to take that look with you.
See what’s possible when your security is built to last.
Contact TCW-GAV to schedule your security assessment.