10/12/2026
“The Real Email Thread That Becomes the Trap”
A BCSI-style business client has been working with an outside accountant for several months. One morning, an employee receives an email inside an existing conversation thread with that accountant.
The sender name, email address, previous messages, signature and history are all correct because the accountant’s mailbox has actually been compromised.
The new message says:
“I’ve uploaded the revised year-end documents. Because the files contain sensitive information, Microsoft is requiring access confirmation. Please review before our meeting this afternoon.”
There is a button: Review Secure Documents.
The employee clicks it.
Instead of asking for a password, it opens what appears to be a normal Microsoft authorization screen. The employee is already logged into Microsoft 365, so there is no suspicious login page.
It asks:
“Allow this application to access your profile and files?”
The employee clicks Accept.
Nothing dramatic happens. The documents even appear afterward.
That is what makes this dangerous.
The attacker may now have granted access through a malicious or unauthorized application. The employee can change their password later and still not immediately understand why suspicious activity continues.
Over the next several days, the attacker quietly studies:
* who approves payments,
* which clients are active,
* internal language and signatures,
* meeting schedules,
* shared documents,
* and who trusts whom.
Then the second stage begins.
A senior employee receives a perfectly written message from the compromised account:
“We need the attached document before tomorrow’s meeting. Can you upload the complete client file to the secure folder?”
Now the company is no longer simply dealing with a phishing email. It may be dealing with unauthorized access, data exposure and impersonation occurring through a trusted relationship.
Bcsi Investigations
604-281-2128
