Holiday Phishing: Office 365

This advisory describes seasonal phishing campaigns targeting Office 365 users—especially finance personnel—where attackers gain access (via brute force, credential phishing, password reuse, or MITM), create mailbox rules to forward or delete mail, and impersonate valid accounts to defraud customers. It recommends detection and response actions such as enabling and exporting O365 audit and mailbox logs (retain locally beyond 90 days), automating detection for failed logins and mailbox rule changes, implementing MFA and least-privilege policies, enforcing stronger password practices, and using VPNs or SOC monitoring to reduce risk.