When people picture an account being hacked, they picture someone guessing a password. That does still happen, but it is no longer how most business accounts fall. The routes that succeed today mostly go around the password entirely — which is why “we use strong passwords” is no longer a complete answer to the question of whether your accounts are safe.
Here are seven ways attackers get in that catch businesses off guard, and what actually stops each one.
1. Stolen session cookies
When you log in and check “keep me signed in,” your browser stores a session cookie — a token that proves to the service that you already authenticated. Malware that reaches a workstation can copy those cookies and replay them from the attacker’s machine. Because the session is already authenticated, multi-factor authentication is never prompted.
What helps: conditional access rules that bind sessions to a compliant device, shorter session lifetimes for administrative accounts, and endpoint protection that catches the info-stealer before it runs. Signing out of sensitive services rather than closing the tab matters more than people think.
2. Adversary-in-the-middle phishing pages
A modern phishing kit does not just collect your password. It sits between you and the real Microsoft or Google login page, passes your credentials through, prompts you for your MFA code, passes that through too, and captures the resulting session. You get logged in successfully. So does the attacker.
What helps: phishing-resistant MFA — passkeys, Windows Hello for Business, or FIDO2 security keys. These are cryptographically bound to the real domain, so a lookalike site simply cannot complete the handshake. This is the single highest-value upgrade most small businesses can make right now.
3. MFA fatigue
An attacker who has your password but not your second factor can simply request approval over and over. At eleven at night, after the fortieth push notification, someone taps Approve to make it stop. It works often enough that it is a standard technique.
What helps: switch push approvals to number matching, which requires the user to type a code shown on the login screen. Then tell your team explicitly: an unexpected MFA prompt is a security incident to report, not an annoyance to dismiss.
4. OAuth consent grants to malicious apps
This one is quiet and badly underestimated. A user clicks “Sign in with Microsoft” on a third-party tool and approves a permissions request that includes reading all mail and files. No password is stolen. No MFA is bypassed. The attacker now has standing API access that survives a password reset.
What helps: restrict user consent in Microsoft 365 so that apps requesting sensitive permissions require administrator approval, and audit existing consent grants. Most tenants we review have several apps nobody remembers approving.
5. Password reuse surfacing in someone else’s breach
Your systems can be flawless and your account can still fall, because an employee used their work email and a familiar password on a retail site that got breached. Attackers buy those lists and try the combinations against business services automatically. This is credential stuffing, and it is cheap, fast, and completely automated.
What helps: a password manager so that every account has a unique password nobody has to remember, plus dark web monitoring on your domain so you find out when staff credentials appear in a dump.
6. Legacy protocols and app passwords
Older mail protocols like IMAP, POP, and SMTP AUTH do not support multi-factor authentication. If they are still enabled anywhere in your tenant — often for one old scanner, one copier, or one accounting integration — they are an authenticated door with no second lock on it, and attackers scan for exactly this.
What helps: disable legacy authentication tenant-wide and move the handful of devices that need it onto modern authentication or a restricted, IP-limited service account.
7. SIM swapping and SMS interception
If your second factor is a text message, your account security rests on your mobile carrier’s customer service desk. An attacker who convinces the carrier to port your number receives your codes. For an owner or a finance lead with access to banking and payroll, that is a serious exposure.
What helps: move off SMS for anything that matters. Use an authenticator app at minimum, passkeys or hardware keys for privileged accounts, and add a port-out PIN with your carrier.
The pattern behind all seven
Notice that only one of these seven is really about password strength. The rest are about sessions, consent, protocol configuration, and how your second factor is delivered — the plumbing of identity rather than the password itself. That is where account security work actually lives now.
The good news is that the fixes stack. Phishing-resistant MFA, disabled legacy authentication, restricted app consent, and conditional access together close six of the seven routes above, and they are all configuration rather than new products.
If you are not sure which of these are already handled in your environment, we can tell you. Ask us for a review of your identity setup and you will get a plain-English list of what is protecting you and what is not.