7 Unexpected Ways Hackers Get Into Business Accounts
Ask most people how accounts get hacked and they will say weak passwords or a dodgy email. Both are still common. But as more businesses switch on multi-factor authentication (MFA), attackers have moved to methods that get around it, or that never touch your password at all.
Here are seven less obvious ways criminals get into business accounts, and what a small business can do about each one.
1. Stealing your session instead of your password
When you sign in to Microsoft 365 or Google, your browser stores a session token so you do not have to log in again every few minutes. Some phishing kits now place a fake login page between you and the real one. You enter your password and approve MFA as normal, and the attacker captures the session token that results. With it, they are already signed in.
What helps: phishing-resistant MFA such as passkeys or security keys, which will not work on a fake site, and sign-in rules that block logins from unknown devices or unusual countries.
2. MFA fatigue
If an attacker already has a password, they can trigger sign-in approval requests over and over, often late at night, hoping a tired staff member taps “Approve” just to make it stop. Sometimes they follow up with a call pretending to be IT support.
What helps: number matching in your authenticator app, so the user must type a code shown on screen, and a clear rule that staff never approve a request they did not start. Unexpected prompts should be reported, because they mean the password is already known.
3. Malicious app consent
Instead of asking for your password, some phishing emails ask you to “allow” an app to access your account. It looks like a normal Microsoft or Google permission screen. Once approved, the app can read email and files without needing your password, and changing the password does not remove it.
What helps: stop staff from approving third-party apps themselves, so requests go to an administrator, and review connected apps regularly.
4. Infostealer malware on home computers
Infostealers are malware that quietly copy saved browser passwords, cookies and session tokens, then send them to criminals. They often arrive through pirated software, fake browser extensions or game cheats, sometimes on a shared family computer that a staff member also uses for work.
What helps: keep work on business-managed devices with up-to-date security software, use a password manager rather than saving passwords in the browser, and limit which devices can access company data.
5. SIM swaps and number porting
If your MFA codes arrive by SMS, a criminal who takes over your mobile number receives them too. They do this by convincing a telco to move your number to a new SIM or another provider. Australian rules have tightened: ACMA introduced an industry standard in 2020 requiring extra identity verification before a mobile number is ported, and from 30 June 2022 telcos must use stronger checks for SIM swaps and other high-risk requests. The risk is lower than it was, but SMS remains one of the weaker forms of MFA.
What helps: move important accounts from SMS codes to an authenticator app, passkey or security key.
6. Forgotten and shared accounts
Old accounts are easy targets: a former employee’s mailbox that was never closed, a shared “reception” or “accounts” login, or a test account set up years ago. These often have weak passwords, no MFA and nobody watching them.
What helps: remove accounts promptly when people leave, give everyone their own login, and make sure no account is exempt from MFA. Our article on password spraying shows how attackers find exactly these accounts.
7. Impersonating staff to the helpdesk
Why hack an account when you can ask for it to be reset? Criminals call or message a helpdesk pretending to be a staff member who has a new phone and is locked out. AI voice cloning makes this more convincing than it used to be.
What helps: a firm verification process for password and MFA resets, such as a call back to a number already on file, approval from a manager, or both. Apply the same caution to payment changes requested by phone or email.
How to protect your business
Most of these attacks are blocked by the same handful of controls:
- Strong MFA on every account, ideally phishing-resistant. The ASD’s Essential Eight requires phishing-resistant MFA from Maturity Level Two. Our Essential Eight checklist for small business explains where to start.
- Sign-in rules that block risky locations and unmanaged devices.
- Admin approval for third-party apps.
- Managed, updated devices for work.
- A clear reset process that cannot be talked around.
- Monitoring and alerts for unusual sign-ins and new mailbox rules.
- Short, regular staff training on what these attacks look like.
Quick checklist
- MFA on every account, with no exceptions.
- Number matching or passkeys switched on.
- Staff cannot approve third-party apps without an administrator.
- Leavers’ accounts disabled on their last day.
- Important accounts moved off SMS codes.
- Written process for password and MFA resets.
Our managed IT security service puts these controls in place and includes 24/7 monitoring, so suspicious sign-ins are spotted early.
Could an attacker get past your MFA?
Our free IT Health Check reviews your sign-in settings, app permissions and account hygiene, and shows where an attacker would most likely get in.
Or call 1300 133 770.
