Every breach report for the last decade has started the same way. Someone clicked a link. It is not because users are careless. It is because phishing is a volume game played against defences that mostly rely on the user noticing something is off.
The attacks are not cleverer. They are better targeted.
The phishing emails that actually succeed in 2026 do not come from a Nigerian prince. They come from “Microsoft Security” at 9:03 on a Monday morning, quoting your exact email address, asking you to re-authenticate to Office 365. The link goes to a domain that looks right. The login page looks right. And if you have not enforced phishing-resistant MFA, it works.
Worse still, AI has industrialised the spear-phish. Generating a convincing message in someone’s tone of voice now takes thirty seconds, not thirty minutes. Your CEO’s “urgent invoice approval” email really does look like your CEO wrote it.
What a modern phish actually looks like
It is worth understanding the mechanics, because the defences only make sense once you do.
The attacker sends a link to a page that sits between the user and the real Microsoft login. The user types their password into what looks like Microsoft; the proxy passes it to the real Microsoft; Microsoft asks for the MFA code; the user types that in too, and the proxy passes it on. The attacker now holds a signed-in session token and does not need the password or the code again. This is why “we have MFA” is no longer the reassurance it used to be: a six-digit code typed into the wrong page is captured just as easily as a password.
The kits that do this are sold as a service, with a dashboard, support and templates for every major cloud provider. The person sending the email does not need to understand any of it.
From there the usual playbook is quiet. The attacker sets an inbox rule to hide replies, watches for invoice conversations, and at the right moment sends a “our bank details have changed” email from the genuine mailbox. The first anyone knows about it is when a supplier chases a payment that went somewhere else.
What stops it, in order of impact
Phishing-resistant MFA. SMS codes are dead. An attacker who captures your password in a phishing form can sit in the middle and capture the code too. Move to authenticator apps with number matching, FIDO2 keys for admins, or Windows Hello for Business. All three genuinely stop the session-hijack phish, because the credential is bound to the real site and cannot be replayed through a proxy.
Conditional access. If sign-in from an unknown device in a new country triggers a risk signal, block it. Entra ID conditional access does this. Most M365 Business Premium tenants have it licensed and switched off. The single most useful policy is “require a compliant, managed device”: a stolen session token is worthless if the tenant will only talk to devices it recognises.
Impersonation protection. Microsoft Defender for Office 365 will flag messages that look like they are from protected users but are not. It catches the “hi, it’s the CEO, please send me gift cards” class of attack. Turn it on.
External sender banners. A simple yellow banner on every external email is one of the highest-ROI controls we know. It is free. Most tenants do not have it.
DMARC, DKIM, SPF. Not because your inbound is affected, but because attackers love spoofing your domain outbound at your suppliers. Get to p=reject within 90 days.
Training and simulations. Short, frequent, real. Not the annual hour of compliance video. Simulated phishing every month, with a friendly five-minute follow-up for anyone who clicks. The click rate drops fast.
Someone watching the sign-ins. All of the above reduces the number of successful phishes. A managed detection service, whether that is Huntress or a SOC watching Defender, catches the ones that get through: the impossible-travel sign-in, the new inbox rule that forwards everything to Gmail, the OAuth app nobody approved. The difference between a phish and a breach is usually how long the attacker had before anyone noticed.
What does not work
Telling users to “be more careful”. We have never seen that as the finding of a breach investigation.
Perfect email filtering. You will always miss a percentage. Assume email will get through, and build the rest of the layers behind it.
Blocking domains after the attack. Attackers burn domains in hours. By the time you block one, the next is in flight.
Password complexity rules. A 16-character password with symbols is captured by a proxy page exactly as easily as “Password1”. Length and rotation policies make life harder for staff and do nothing against the attack that actually gets used.
What to do in the first hour if someone clicks
Even with everything above in place, someone will eventually type their password into the wrong page. What happens next matters more than the click.
Reset the password and, more importantly, revoke every active session for that account. In Entra ID that is “revoke sessions” on the user; it invalidates the token the attacker is holding. A password reset alone does not.
Check the mailbox for inbox rules and forwarding you did not create, and remove them. Look at recent sign-ins for locations and devices you do not recognise. Check for OAuth applications granted consent in the last few days.
Tell the finance team, in person or by phone, that any change-of-bank-details request from that mailbox in the next month is to be verified by a call to a known number. Most of the money lost to phishing is lost in this window, not in the click itself.
Then look at why the click became a sign-in. If the answer is “the tenant allowed a session from an unmanaged device in a country we do not operate in”, that is the fix, not another round of training.
Where to start this week
If the list above feels long, the order matters more than the completeness.
Day one: switch off SMS as an MFA method and turn on number matching in Microsoft Authenticator. Register a passkey or a FIDO2 key for every global admin. This closes the door the session-hijack kits walk through.
Day two: build the three baseline conditional access policies in report-only mode (block legacy authentication, require MFA everywhere, require a managed device for admins) and read the sign-in log at the end of the week.
Day three: enable the External tag in Outlook and add the directors and the finance team to Defender’s impersonation protection list. Both take under an hour.
Then book the DMARC work and the first phishing simulation for next month. Four working days, no new licences on a Business Premium tenant, and the attack that actually gets used against small businesses no longer works on yours.
The honest position
You will not stop every phish. You can stop every phish from becoming a breach. MFA, conditional access, impersonation protection, and a SOC watching for the sign-in anomalies. That is the stack. It is boring, well understood, and it works.
We run this stack for dozens of UK businesses. If yours is missing any of the four, let us show you what a Huntress-monitored tenant actually looks like.