A few months ago, a Pegasus Technologies client employee signed in to Microsoft 365 from Brazil. The problem was that the employee had never left the United States.
Within five minutes, the Pegasus SNAP-Defense service turned that sign-in into an emergency ticket, and the account was locked before the attacker could do any damage. Over the next 12 hours, the same pattern showed up on roughly 14 user accounts and one shared mailbox. Pegasus confirmed with the client that every flagged user was local, blocked the attack at the country level that same evening, and reset passwords and multi-factor authentication (MFA) on every affected account.
The result: no reported data loss, no fraudulent email, and only one shared mailbox locked out for part of an evening.
What is a Microsoft 365 account takeover?
An account takeover happens when an attacker logs in with a stolen or guessed password. Once inside, they can read email, redirect payments and send convincing messages from an address your customers and vendors already trust. It is the most common path into Business Email Compromise (BEC), one of the costliest forms of cybercrime for small and mid-sized businesses.
The dangerous part is that nothing looks broken. A valid login does not set off antivirus software or a firewall alarm. The only clues are where the login came from and how it happened. Without continuous identity monitoring, the first sign of trouble is often a fraudulent invoice or an upset customer.
Four things that made the difference
- Identity-aware detection. The attacker had working credentials, which traditional tools accept. SNAP-Defense judged each login by country, IP address, and VPN, proxy or TOR use, and flagged the ones that did not fit.
- Around-the-clock coverage. The attack continued into Friday evening and the weekend. Alerts kept flowing, and the Security Operations Center (SOC) responded in real time.
- A clear response playbook. Every alert came with the same steps: verify with the user, suspend the account if the login was malicious, and enforce MFA.
- Seeing the whole campaign. Alerts on about 14 accounts from the same source showed a coordinated campaign. That led to blocking entire countries instead of chasing accounts one at a time.
Pegasus engineers then put a same-day geofence in place, restored the locked mailbox before the weekend, and delivered an after-action report so the client’s owners understood exactly what happened.
Attackers log in more often than they break in
Modern attackers rarely force their way through a firewall. They use passwords they already have. SNAP-Defense is built for that reality, and with new AI tools in the Pegasus SOC, many responses now happen in seconds.
Want to know if your Microsoft 365 accounts are being watched around the clock? Contact Pegasus Technologies for managed cybersecurity and IT support across southeastern Pennsylvania.
