7 Unexpected Ways Hackers Get Into Accounts

Ask most people how accounts get hacked and you'll hear two answers: a weak password, or clicking a phishing link. Both still happen. But if your business has already turned on multi-factor authentication and banned "Summer2026!" as a password, attackers haven't given up. They've just moved to the side doors.

The ASD's latest annual cyber threat report found email compromise was the most common cybercrime reported by Australian businesses, with business email compromise fraud close behind. Very few of those start with someone guessing a password. Here are seven routes that don't need one, roughly in order of how often we see them.

1. Stealing the session instead of the password

When you sign in to Microsoft 365 and pass MFA, your browser receives a session token, essentially a wristband that says "already checked". For the next few hours or days, the wristband is all the service looks at.

Attackers get that token two ways. Infostealer malware copies it straight out of your browser. Or an adversary-in-the-middle phishing page sits between you and the real Microsoft login, passes your password and MFA code through in real time, and keeps the token that comes back. You see a normal login. They get a working session.

This is why "but we have MFA" isn't the end of the conversation. The fix: phishing-resistant sign-in (passkeys, Windows Hello for Business or FIDO2 security keys), plus conditional access rules that only accept sessions from managed, compliant devices. Our guide to MFA staff won't try to dodge covers how to roll these out without a revolt.

2. The "enter this code" trick (device code phishing)

Ever signed in to a smart TV app by typing a short code into your phone? That's the device code flow, and it's legitimate. It's also been abused. In February 2025 Microsoft described a campaign by a group it tracks as Storm-2372 that sent targets fake Microsoft Teams meeting invitations. The "join" step asked the victim to enter a code at a genuine Microsoft web page. Doing so signed the attacker's device into the victim's account.

The nasty part is that every page the victim visits is real. There's no dodgy URL to spot. The fix: Microsoft's own recommendation is to block the device code flow wherever you don't need it, which for most small businesses is everywhere. It's a conditional access setting, about ten minutes' work.

3. Calling the help desk

Why phish an employee when you can just ring IT and pretend to be one? That's how the April 2025 attack on UK retailer Marks & Spencer is widely reported to have begun: attackers impersonated a staff member and talked an outsourced help desk into resetting credentials. The company has put the cost of the resulting disruption at around £300 million.

Small businesses aren't immune. The "help desk" might be your office manager, who knows everyone's voice... except it's a mobile call from someone who says they've lost their phone and need MFA reset before a client meeting. The fix: a written rule that password and MFA resets require verification through a separate channel, such as calling back on the number in the staff directory or a video call. No exceptions for urgency, because urgency is the attack.

4. SIM swapping your phone number

If your MFA codes arrive by SMS, whoever controls your phone number controls your account. In a SIM swap, a criminal convinces your telco to move your number to a SIM they hold. Your phone loses signal, theirs starts receiving your texts, and your password reset codes go straight to them.

Australia tightened the rules in 2022. ACMA now requires telcos to use multi-factor identity checks before high-risk actions like a SIM swap, and ACMA has put the average loss for an individual victim at around $28,000. Stronger checks help, but they move the attack rather than end it. The fix: move important accounts off SMS codes and on to an authenticator app or passkey. If your phone suddenly shows "SOS only" for no obvious reason, call your telco straight away.

5. Approving a third-party app

"This app would like to read your mail, access your files and maintain access to data you have given it access to." Most people click Accept without reading it. That's consent phishing: a malicious app, often with a believable name, asks for permission to your Microsoft 365 or Google account. Once granted, it keeps access through an OAuth token, and changing your password doesn't revoke it.

The fix: stop users granting app consent on their own and route requests to an admin for approval. Review what's already connected; there are usually surprises. Our third-party app vetting checklist walks through it.

6. Push fatigue: approve, approve, approve

Push-notification MFA is convenient. Tap Approve and you're in. Which is exactly the weakness. An attacker with your password triggers sign-in after sign-in late at night until you tap Approve just to make your phone stop buzzing. It's a war of attrition, and the attacker has more patience than you at 11pm.

Microsoft made number matching mandatory in its Authenticator app in 2023, so you now have to type a number from the login screen, which kills most of this. But other MFA products, older configurations and some VPNs still use simple approve/deny prompts. The fix: make sure every MFA prompt in the business requires number matching or a passkey, and teach staff that an unexpected prompt means someone has their password. They should deny it and report it, not just ignore it.

7. A password you used somewhere else in 2019

Credential stuffing is old, but it keeps working because of simple maths. Billions of username and password pairs from old breaches are freely available. If even a small fraction of people reuse a password, an attacker testing a million combinations against Microsoft 365 will get thousands of hits, all without guessing anything.

Check whether your work email appears in known breaches at Have I Been Pwned, the free service run by Australian security researcher Troy Hunt. If it does, any password used on that site is burnt. The fix: a password manager so every password is unique, and MFA so a reused password alone isn't enough. If you've had a breach notice recently, follow our eight steps after a data breach notice.

What these have in common

Every one of these goes around the front door rather than through it. That's actually good news, because the fixes are mostly configuration, not new products. Phishing-resistant MFA, conditional access, admin approval for apps, a verification rule for the help desk and blocking device codes. Most Microsoft 365 Business Premium tenants already include the tools; they're just not switched on. A Microsoft 365 security assessment is the quickest way to find out which ones you're missing, and managed detection and response catches the attempts that get through anyway.

Frequently asked questions

How do hackers get into accounts with MFA turned on?

Usually by stealing the session token after you've signed in, through infostealer malware or a real-time phishing proxy, or by tricking you into approving a sign-in or entering a device code. Phishing-resistant MFA and device-based conditional access stop most of these.

Can hackers get into my account without my password?

Yes. Stolen session cookies, malicious app consents, SIM swaps that intercept reset codes and help desk impersonation can all give access without the attacker ever knowing your password.

Is SMS two-factor authentication safe?

It's far better than nothing, but it's the weakest form of MFA because SIM swaps and phishing can intercept the codes. Use an authenticator app with number matching, or better still a passkey or security key, for email, banking and admin accounts.

How do I know if my account has been hacked?

Watch for unexpected MFA prompts, sign-in alerts from unfamiliar locations, new inbox rules forwarding or deleting mail, sent emails you didn't write and unfamiliar connected apps. In Microsoft 365, an administrator can check sign-in logs to confirm.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Not sure which of these doors are open in your Microsoft 365? Ask us for an account security check — we'll find them and close them.