01 / Security response
Following the evidence.
Closing the gap.
A client’s employee scanned a malicious QR code that had slipped past the email filter, giving an attacker access to their mailbox.
Reviewing the logs, I found the attacker had sent payment requests to the client’s billing team and created a mailbox rule to hide the replies. I contained the compromise the same day and worked with the bank to recall the wire.
To close the gap, I added QR-code scanning to the email filter. MFA was already enforced, so in Microsoft Entra ID I disabled the specific MFA method the attacker had exploited for all 100+ mailboxes.
Same-day containment, the full $10,000 wire recovered through a bank recall, and the attack path closed across the entire organization.