Historical March 2025 client account. Wording reviewed 15 September 2026 to distinguish reported response actions from unproven forensic conclusions.
The familiar email was the hook
On 24 March 2025, an ITFR client received a document request from their lawyer’s compromised email account. The signature and expected paperwork made the message appear credible.
The client followed the link, encountered a page presented as a Microsoft 365 Face ID or passkey sign-in, became suspicious and called the after-hours support team. The important action was reporting the concern promptly.
A real mailbox can send a malicious request.
Familiar sender does not prove safetyThe client contacted support after the suspicious prompt.
Case-study turning pointCheck the actual sign-in and cloud evidence.
A screen label does not prove the authentication flowThe original account does not establish that passkey cryptography was defeated or quantify data access.
How the response was approached
Contain the identity risk
The team acted to restrict access and revoke sessions.
What to check
Revocation is not necessarily instantaneous in every application. Investigators must verify the effect rather than assume every session ends at once.
Look for persistence
The response reviewed authentication and application access.
What to check
Check newly added methods, application consents and other relevant account changes alongside sign-in activity. Do not infer the attacker’s precise path from the appearance of a fake page.
Notify and follow through
The law firm was alerted to the compromised sending account.
What to check
The existing account records prompt containment activity. Avoid interpreting that as a forensic guarantee that no data was accessed unless investigation evidence supports it.
Keep the distinction clear
Genuine passkeys are phishing-resistant. A passkey-themed lure may instead abuse another permitted flow or a compromised session. Strong authentication remains valuable.
Pair safer sign-in with enrolment controls, device protection and an easy way for staff to report an unexpected request.
Sources & further reading
Make the next step practical
Talk to ITFR about your business, priorities and the controls that fit.
