The Perfect Context

There was nothing unusual about the email. At least, that was how it looked to him.

Cybercrime: Malice in Everyday Life — Part 2

You don't have to be someone special to be targeted.

Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.

Checks Before the Long Weekend

It was a Friday, just before a long weekend.

Corey, who handled administrative work at a small logistics company, was checking an email from a business partner.

Shipment tracking numbers, handover statuses, invoice amounts. As the end of the month approached, there was more than usual to verify.

That day, too, he was cross-checking shipping records while moving between several email threads.

Just after noon, a message arrived notifying him that a shared file had been updated.

"We've updated the delivery performance report you asked us about the other day. You can review it here."

The sender's name looked familiar. It was the name of the person he usually dealt with at the partner company.

The message also related directly to work that was already in progress.

Corey clicked the link.

A login page for the cloud service his company routinely used appeared.

"Please sign in again."

The page asked him to enter his email address and password, so he did.

He was then asked to complete a multi-factor authentication check.

He opened the authentication app he always used and entered the number displayed.

After a short wait, the screen returned to his usual email inbox.

Nothing seemed wrong.

Corey was a little puzzled that he could not see the supposedly updated delivery report, but with the pre-holiday rush keeping him busy, he moved on to another task.

While He Knew Nothing

A few hours later.

Someone other than Corey was accessing his email account.

The attackers had obtained more than just his email address and password.

When Corey signed in to the legitimate service, they had also stolen the information that proved he was logged in.

Web services commonly use a mechanism that keeps a user's session active for a certain period after authentication, so that the user does not have to enter a password every time.

One piece of information stored in the browser for this purpose is called a session cookie.

Think of it as a temporary pass given to someone after their identity has been checked at the entrance to a building.

The attackers had obtained that pass.

Unlike conventional phishing, which simply steals the password a person enters, this attack intercepted the authentication process while it was taking place.

          Corey
            |
            | Enters login credentials and authentication code
            v
   [Attacker-controlled relay site]
            |
            | Relays the connection to the real service
            v
      [Legitimate login service]
            |
            | Authentication succeeds; session is issued
            v
   [Attacker obtains session information]
            |
            v
   [Attacker accesses the service as Corey]

This technique is known as Adversary-in-the-Middle (AiTM).

On the screen, it looks as though the user is signing in to the genuine service. Authentication with the legitimate service really does take place.

But the attacker steps into the middle of that process and captures both the login information and the session information issued after authentication.

In other words, Corey was not simply tricked into entering his credentials on a fake login page.

The attacker intercepted the result of an authentication process that Corey had completed correctly.

Who Had Sent the Reply?

The next business day.

A representative at the partner company called him.

"We received a message from you about the invoice we discussed last week. It says the bank account for payment has changed. Should we transfer the money to this account?"

Corey had no idea what they were talking about.

He checked his email and found a reply that had indeed been sent from his own account.

It was part of the ongoing invoice correspondence, and it instructed the recipient to send payment to a different bank account.

Attached was an invoice that looked entirely plausible.

But the account listed on it did not belong to Corey's company.

The partner company had called to confirm the change, so the transfer was stopped before any money was sent.

An internal investigation began.

There was an unfamiliar login in the activity history of Corey's email account. The attackers had also created a rule that automatically moved incoming messages into another folder.

That way, Corey would not notice when the partner company replied to ask about the change.

The attackers had done more than take over an email account.

They had read previous messages, examined the company's relationships with its business partners and the invoices currently being processed, and looked for someone they could persuade to transfer money.

Then they used Corey's name and his actual email account to try to deceive the partner company.

The company revoked the account's active sessions and changed the password. It checked the email forwarding settings and inbox rules, and contacted the business partners involved.

For some time afterward, however, Corey kept checking messages that he had no memory of sending.

What had they read?

Who had they emailed?

Could they have misused other conversations with business partners?

How much investigating would it take before he could feel safe again?

Did Two-Factor Authentication Really Fail?

Attacks like this have been documented in the real world.

In July 2022, Microsoft published details of a large-scale campaign that used AiTM phishing.

According to the company's investigation, the campaign had targeted more than 10,000 organizations since September 2021.

The attackers captured not only users' passwords but also their session cookies after authentication. This allowed them to impersonate users with stolen session information, even when multi-factor authentication (MFA) was enabled on the accounts.

Afterward, the attackers examined the mailboxes and searched for ongoing email threads involving invoices and payments.

Microsoft's analysis identified cases in which the attackers moved on to the next stage of financial fraud just five minutes after stealing the credentials and session information.

The attackers also created malicious inbox rules to hide replies from the people they were trying to defraud.

This was not merely an attack that took over an individual's account. It exploited the business relationships and trust that person had built over time.

Phishing is also reported on a large scale in Japan.

According to the Anti-Phishing Council of Japan's Phishing Report 2026, the organization received 2,454,297 phishing reports in 2025, approximately 1.43 times the number reported in 2024.

These figures represent reports received by the council, not the number of victims or successful scams. Even so, they show that phishing is not a passing trend, but an ongoing problem.

What Should He Have Checked?

Corey was not someone who struggled to recognize suspicious emails.

He was careful with messages from unfamiliar senders. He watched out for unnatural wording and invoices he was not expecting. He had also enabled multi-factor authentication.

And yet, he had not been able to stop this attack.

The sender's name was familiar.

The subject matter made sense in the context of his work.

The login page and authentication process looked exactly as they usually did.

And the sign-in completed successfully.

We have been taught to check the sender, the wording of the message, and the URL when trying to identify phishing.

Those checks are still important.

But what if the attacker already knows what is happening in your workplace?

What if the message fits an actual business process and arrives at exactly the right moment?

What if the screen looks just like the service you normally use, and the authentication process proceeds as expected?

And what if the successful login itself was exactly what the attacker wanted?

"I'm safe because I've enabled two-factor authentication."

That belief is not wrong. Multi-factor authentication is an important safeguard that protects accounts against many kinds of attacks.

But it does not protect against every possible attack on its own.

What Corey kept looking back at was the unfamiliar sent-mail activity in his inbox.

His name was clearly displayed beside those messages.

He had no memory of sending them.

And yet, to the people who received them, the messages had unquestionably come from him.

References

1. Microsoft Security Blog, "From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud," July 12, 2022.
   
   https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/

2. Anti-Phishing Council of Japan, Phishing Report 2026, June 1, 2026.
   
   https://www.antiphishing.jp/report/report/phishing_report2026.html

This story is a fictional reconstruction based on Microsoft's published findings on AiTM phishing and business email compromise. Corey, the logistics company, the conversations with its business partner, and the circumstances in which the attempted transfer was prevented are fictional; the story does not depict any specific real-world company or victim.

The Anti-Phishing Council of Japan, cited for the domestic reporting figures, is a Japan-based organization.