A US investment firm lost $1.5 million in cryptocurrency after cybercriminals compromised its Microsoft 365 environment, hijacked email conversations and tricked the business into transferring funds to the wrong destination.
The scam did not involve hacking a trading platform or breaching a cryptocurrency exchange. Instead, attackers exploited trust in business email communications, making the fraudulent transaction appear legitimate.
According to a case study published by cybersecurity company J2 Software on October 14, the attackers gained access to the firm’s Microsoft 365 environment and manipulated its Outlook settings. They created rules to intercept emails related to a planned cryptocurrency investment, alter transaction details and send messages that appeared to come from the legitimate investment counterparty.
Subtle changes to email addresses made the deception difficult to detect, particularly because the sender’s display name appeared more prominent than the actual address.
The firm initially transferred a small amount of cryptocurrency as a test. After the attackers confirmed receipt, the business was instructed to transfer the remaining investment. Believing it was communicating with its genuine investment partner, the firm authorised the larger payment.
The fraud came to light only when the legitimate investment company contacted the firm to ask why the funds had not arrived. Both parties then discovered that criminals had effectively created two separate conversations, leaving each side unaware of the deception.
Following the incident, the firm removed unauthorised Outlook rules and brought in J2 Software to investigate and secure its Microsoft 365 environment. Measures included tightening access controls, addressing security misconfigurations and introducing additional monitoring to detect suspicious activity and potential account takeovers.
The company subsequently retained J2 for ongoing cybersecurity support.
However, recovering the stolen cryptocurrency has proved difficult. More than a year after the incident, the firm was still pursuing the funds through legal proceedings, according to J2.
The case highlights how business email compromise can lead to major financial losses without directly breaching financial platforms. By taking control of trusted communications, scammers can manipulate legitimate payment processes and persuade victims to authorise transfers themselves.
