Everything You Were Taught to Check Passed. It Was Still a Trap.
October 27, 2026
For years, small-business security training has boiled down to the same handful of habits. Check the sender's email address. Hover over the link before you click. Look for the padlock in the browser. Turn on two-factor authentication (2FA) so that even if someone gets your password, they still can't get into your account.
Earlier today, an email landed in our inbox that was built specifically to pass every single one of those checks.
It looked like a routine request for proposal (RFP) from a known contact, with a PDF attached. Because we never click unexpected attachment links directly, we pulled the file into an isolated sandbox to see what it was actually doing. What we found is a textbook look at how business email compromise works right now, and why "just train your employees to be careful" isn't enough anymore.
How the trap passed every visual check
If a busy office manager or bookkeeper had paused and run through their normal security checklist on this email, here is what they would have seen:
- The sender was real. Nobody registered a lookalike domain or spoofed a display name. The email came from a known contact's actual mailbox, which had been quietly compromised.
- The link inside the PDF was a legitimate Intuit address. Hovering over the button inside the RFP attachment didn't show a sketchy overseas address. It pointed to links.notification.intuit.com, a real, signed click-tracking link used by Intuit and QuickBooks.
- The page opened with a familiar security check. Following that link led to a convincing "Verify you are human" checkbox before presenting a Microsoft SharePoint and Microsoft 365 sign-in screen.
Every visual cue told the reader they were looking at a known contact, a trusted accounting platform and a normal Microsoft login.
How attackers piggybacked on Intuit and bypassed 2FA
When we traced the redirect chain inside our sandbox, the mechanics behind the scenes told a very different story.
First, the attackers abused a QuickBooks account to generate the link. By placing their own destination address into a notification or invoice field and having Intuit's system email it out, they got Intuit's email infrastructure to wrap their link inside an official links.notification.intuit.com tracking address. Because the PDF only contained a trusted Intuit link, standard email spam filters waved it right through.
Second, the moment someone clicked that Intuit link, it silently redirected them to a recently re-registered foreign domain sitting behind Cloudflare. That page served a fake verification gate designed to keep automated security scanners out while letting real people through.
Third, the Microsoft 365 login screen waiting behind that checkbox wasn't a static copy of a login page. It was a live Adversary-in-the-Middle (AiTM) proxy sitting between the victim and Microsoft's real servers. When someone types their email, password and six-digit 2FA code into a proxy like that, the attacker's server passes those details to Microsoft in real time and captures the resulting session cookie. Once the attacker has that post-2FA session token, they don't need the password or the phone anymore. They are already signed in.
Instead of replying to the email thread, we picked up the phone, called the contact on a known number and let them know their email account had been hijacked.
Why you can't just hit "Reply" to verify
That phone call matters for a reason most people don't see. When attackers hijack a business mailbox to send out fake RFPs or updated wiring instructions, one of the first things they do is create hidden inbox rules in the victim's email account.
If you reply to the email asking, "Did you mean to send this?", the real sender never sees your message. The attacker's rule routes your reply straight to a hidden folder or the trash, and the attacker replies right back assuring you the document is legitimate. The only safe way to verify an unexpected file, invoice or payment change is out-of-band: calling a phone number you already had on file before the email arrived.
What actually stops an attack like this
You cannot reasonably expect a busy employee to spot a hijacked mailbox, recognize that an official intuit.com link is going to redirect somewhere else, and tell the difference between a real Microsoft 365 sign-in page and a live reverse proxy.
Keeping a small business safe from this kind of attack takes guardrails inside your systems and workflows, not just sharper eyes in the inbox:
- Locking down Microsoft 365 beyond basic 2FA, using Conditional Access policies, device-compliance checks and risky sign-in blocks so a stolen session cookie can't simply be replayed from an attacker's server across the world.
- Monitoring your tenant for quiet post-login changes, especially new inbox forwarding rules, suspicious OAuth app grants and impossible-travel sign-ins that show a mailbox was just taken over.
- Requiring out-of-band phone verification on a known number whenever a contact sends an unexpected document link, a new portal login or a change to payment details.
- Giving your team a safe way to flag and detonate suspicious files without opening them on the same machine that holds your company's live sessions and files.
That is the kind of practical defense we put in place and manage every day for the businesses we support. If you aren't sure whether your Microsoft 365 environment would stop a stolen session token after a link like this gets clicked, let's take a look before someone in your office has to guess.
Talk with our team about locking down your Microsoft 365 environment