BEC attack used stolen session to reroute vendor payments

A cybersecurity firm reported a business email compromise attack that began with a spear phishing message aimed at a finance employee. The attacker used a fake login page to get around multifactor authentication, took over a Microsoft 365 session, and then hid incoming emails while changing payment details so vendor funds were sent to accounts controlled by the attacker. This kind of attack matters because it can turn one stolen login into direct payment loss and make the fraud hard to spot for weeks. A service like Sender Registry helps businesses check sender identity and spot suspicious messages, so finance teams are better able to catch impersonation, payment redirection, and other signs of email fraud before money moves.