Yes, phishing can get past multifactor authentication, and in October 2026 it was aimed squarely at law firms. Canada's national cyber agency warned of a campaign that impersonates internal IT support, with October activity concentrated on the legal sector, that gets past standard MFA by relaying the sign-in in real time. In the same weeks, two large Canadian firms, McCarthy Tétrault and Davies, confirmed breaches, researchers at Huntress published a campaign that took over 97 Microsoft 365 accounts at 79 organizations, and Arctic Wolf documented more than 400 incidents of fake help desk staff reaching employees through Microsoft Teams.
The fix is not to drop MFA. It is to stop letting a stolen sign-in work from anywhere, to use MFA that cannot be relayed for the people who matter most, to close the Teams door strangers walk through, and to give every employee one simple rule about anyone who says they are from IT. Below is what employees actually saw, what happened at the firms, the numbers behind it, a 10-minute self-check and the fixes in the order we would make them.
The call from "IT": what employees actually see
It usually starts with a mess. Arctic Wolf's research, published by Help Net Security (opens in a new tab) on October 27, 2026, describes a pattern seen in many of more than 400 incidents. First, the attacker signs the employee up for a flood of newsletters and subscriptions, so their inbox fills with hundreds of confirmation emails in minutes. The employee cannot find real mail and starts to panic a little.
Minutes later, a message arrives in Microsoft Teams from an account named something like Help Desk or IT Support, often with "(Internal)" added to the display name so it looks like a colleague, even though Teams marks it as external. The fake technician offers to fix the email problem. Once the employee replies, the chat moves to a Teams voice call. The caller asks the employee to open Quick Assist, a remote support tool built into Windows, and read back a six-digit code. That code hands over control of the computer. AnyDesk and ScreenConnect show up too, sometimes as a backup way back in.
From there it moves fast. Arctic Wolf found attackers often target several employees at the same company within about five minutes, that malicious code can start running in under 15 minutes, and that in some cases credential theft alerts went off at the same time as the alert for the first Teams chat, so the computer was already compromised by the time anyone looked. Some intrusions ended in data theft or ransomware. The researchers explained why it works: "Employees are generally trained to treat email with suspicion," but a message that shows up inside the company's own Teams environment tends to get around that caution.
Law firms have been warned about this exact trick before. In May 2026, the FBI said a group called Silent Ransom Group, also known as Luna Moth, makes law firms its main target, according to Help Net Security (opens in a new tab). It calls and emails employees while posing as IT staff, talks them into opening remote desktop sessions, and when that fails sometimes sends a person to the office claiming they need to back up a computer. After it steals data, it threatens to publish it and contacts employees or clients to add pressure.
Two law firms, two days, and a national warning
According to The Globe and Mail (opens in a new tab), McCarthy Tétrault discovered its breach late on October 22. The firm said an unauthorized third party gained access to certain files, including information relating to clients. One source told the paper 31,000 files were taken, a number the firm would not confirm. The firm's statement said: "We sincerely regret the concern this incident may have caused our clients, our people and the organizations we work with."
Davies Ward Phillips & Vineberg said a cyberattack on October 23 led to a compromise of information from one account. Both firms hired outside experts and notified law enforcement and clients. Two sources told the paper that phishing was used in at least some of the law firm breaches, and one said attackers in some cases posed as internal IT staff on Microsoft Teams and asked employees for access to their computers. Neither firm has said publicly exactly how its attacker got in.
The Canadian Centre for Cyber Security then issued an alert describing a campaign aimed at financial and legal organizations since July, with October activity concentrated on the legal sector. It said multiple Canadian firms had been targeted by people impersonating internal IT support, who send employees to fraudulent sign-in pages. The alert said the campaign "bypasses conventional multi-factor authentication (MFA) through real-time relay and frequently rotates lure domains."
This is not only a Canadian problem. Firms in Los Angeles run on the same Microsoft 365, Teams and Windows remote support tools as the firms in Toronto, and the FBI warning above was about American firms. If your firm handles litigation, real estate closings, estate planning or settlements, you hold exactly what these groups want: confidential files and money in motion. Our guide to what to do in the first 72 hours after a law firm data breach covers the response side.
How a fake sign-in page gets past MFA, in plain words
Most MFA works like this: you type your password, then approve a prompt or enter a code, and Microsoft hands your browser a session token, a digital pass that says you already proved who you are. From then on, the token is what keeps you signed in.
In a relay attack, also called adversary in the middle, the employee lands on a fake sign-in page that looks exactly like Microsoft's. Behind the scenes, that page passes everything to the real Microsoft sign-in as it is typed. The employee enters the password, gets the real MFA prompt on their phone, approves it, and lands in their real mailbox. Nothing looks wrong. The attacker keeps a copy of the session token that Microsoft issued at the end. As the Huntress researchers put it (opens in a new tab): "Because that token is minted after MFA, whoever holds it doesn't need to pass MFA again."
Huntress's October 22 report shows how fast this moves at scale. Between July 14 and September 22, 2026, it tracked 497 successful sign-ins from more than 200,000 attempts, with stolen tokens replayed from rented servers within minutes of the victim's MFA step. Some tokens came from relay pages. Others came from device code phishing, where a victim is talked into entering a short code on a real Microsoft page, which quietly signs in the attacker's device instead. Huntress calls the bulk replay "token spraying."
That is why the type of MFA matters. Text codes, app codes and push approvals can all be relayed because the person on the other end of the fake page simply forwards them. Passkeys and hardware security keys are tied to the real website address, so a fake page cannot use them even if the employee is fooled.
What the attackers did once they were inside the mailbox
The first sign-in is not the scary part. It is what the attacker sets up so they can stay and get paid. Huntress and The Hacker News (opens in a new tab) describe the steps, and each one leaves something you can look for.
| What they did | Why it matters | Where to look |
|---|---|---|
| Registered at least 48 fake devices named DESKTOP- plus eight characters | The device keeps access alive until someone deletes it | Devices list in Microsoft Entra, or each user's device list |
| Removed existing MFA methods and added their own in 19 organizations, within three hours | The attacker now gets the MFA prompts, not the employee | Each user's registered sign-in methods |
| Created hidden inbox rules named things like "." and "sss" | Replies, warnings and bank emails disappear from the real user's view | Outlook inbox rules, including mail moved to RSS Feeds or Conversation History |
| Watched for payroll, direct deposit, bank and bonus emails and hid all mail from an outside accountant | Sets up payroll or payment fraud from a trusted account | Rules that mention payroll or banking words |
That last row is where the money goes. In one case, the attacker set a rule to catch any message about payroll, direct deposit, bank or bonus, created a second rule that hid all mail from the company's outside CPA, and then used the real account to send that CPA a payroll-related email. Any reply would land in a hidden folder. Nobody inside the company would see the conversation until the money was gone. This is how a stolen session turns into business email compromise.
It is also why the usual first reaction does not work. Huntress was blunt: "A password reset alone does not remove attacker-registered devices or MFA methods." If you change the password and stop there, the attacker's device and authenticator keep working.
The numbers: phishing, payroll fraud and law firm ransomware in 2025 and 2026
The FBI's 2025 Internet Crime Report (opens in a new tab) makes the business case on its own. Phishing and spoofing were the most reported crime type of the year. Business email compromise was the second most expensive, behind only investment fraud. And among ransomware complaints from businesses outside the critical infrastructure sectors, legal services, meaning law firms and estate planning, was the most reported industry.
| Statistic | Number | Source |
|---|---|---|
| Phishing and spoofing complaints | 191,561, the most of any crime type | FBI IC3 2025 report |
| Business email compromise losses | $3.05 billion across 24,768 complaints | FBI IC3 2025 report |
| Tech and customer support scam losses | $2.13 billion across 47,794 complaints | FBI IC3 2025 report |
| Share of non-critical-sector ransomware complaints from legal services | 18%, the most of any industry | FBI IC3 2025 report |
| California cybercrime complaints and losses | 116,414 complaints and $3.67 billion, both first in the nation | FBI IC3 2025 report |
| Rise in identity-based attacks, first half of 2025 | 32% | Microsoft Digital Defense Report 2025 |
| Identity attacks stopped by phishing resistant MFA | Up to 99% | Microsoft Digital Defense Report 2025 |
| Most common way into breached organizations | Phishing, 17% of breaches, average cost $5.9 million | IBM Cost of a Data Breach 2026 |
| Fake help desk incidents through Teams external chat | More than 400 | Arctic Wolf, October 2026 |
Microsoft's 2025 Digital Defense Report announcement (opens in a new tab) adds an important balance. Over 97% of identity attacks are still mass password guessing, and phishing resistant MFA has been shown to stop up to 99% of them. Relay attacks are the smaller, smarter slice that gets through ordinary MFA, which is exactly why firms with money in motion need the stronger kind for their key people.
IBM's 2026 study, as reported by The HIPAA Journal (opens in a new tab), found phishing was the most common way into breached organizations, at 17% of breaches, with an average cost of $5.9 million. Your firm will not see a number that size, but the pieces are the same: a wire that cannot be recalled, client notifications, outside counsel and forensics, insurance questions, and clients who wonder whether their files are safe with you.
What was missed: MFA with no limits, an open Teams door and no rule about IT
In the Huntress cases, MFA was on. What was missing was a second layer that asks whether a sign-in makes sense: is this a known device, is it coming from a hosting company's server, is it using a sign-in method this firm never uses? Where that layer existed, it worked. Huntress wrote: "Conditional Access did real work here." One attacker address was blocked 1,052 times, and every block came from four organizations whose Conditional Access policies refused the sign-ins.
The second gap is the Teams door. Arctic Wolf noted that Teams ships with external access turned on by default, so any Teams user in another company can find, chat with and call your employees, and the attack abuses that normal feature rather than any software flaw. Most small firms have never looked at this setting.
The third gap is human. An employee who gets a Teams message or a phone call from someone claiming to be IT has no rule to fall back on, so they try to be helpful. The FBI's advice is direct: verify anyone claiming to be internal IT before you grant remote or physical access, restrict remote access tools that are not approved, and review how your help desk handles password resets and access requests.
Finally, the type of MFA. Codes and push approvals can be relayed. The CISA #StopRansomware Guide (opens in a new tab) tells organizations to implement phishing resistant MFA for all services, especially email and remote access. Our guide to phishing resistant MFA explains the options in plain terms.
Your 10-minute self-check, plus five free tools
Set a timer for 10 minutes. Some checks any employee can do on their own account; a few need whoever manages your Microsoft 365. Any answer in the red flag column is worth fixing this month.
| Check | How to do it | Red flag |
|---|---|---|
| Your sign-in methods | Go to mysignins.microsoft.com/security-info and look at the list | A phone, app or key you do not recognize |
| Your devices | Go to myaccount.microsoft.com and open Devices | A computer named DESKTOP- plus random characters that is not yours |
| Your inbox rules | In Outlook, open Settings, then Mail, then Rules | A rule with an odd name like a dot, or one that moves mail to RSS Feeds |
| Teams external access | Ask your IT admin whether Teams accepts chats and calls from any outside company | Yes, from anyone |
| Quick Assist | Search the Start menu on a staff computer for Quick Assist | It opens, and your IT provider does not use it |
| MFA type for partners | Ask what second step partners and the bookkeeper use | Text message codes or simple push approvals only |
| Payment changes | Ask your bookkeeper how a change to direct deposit or wire details is confirmed | By replying to the email that asked for it |
Then use our free tools. The five-minute phishing quiz shows eight realistic emails and teaches the clues that give fake ones away; have every attorney and staff member take it this week. The email security check tests your domain's SPF, DKIM and DMARC records, which decide whether criminals can send email that appears to come from your firm's own address.
The lookalike domain check finds registered domains that look like yours, the kind used to host fake sign-in pages or to email your clients pretending to be you. The password leak check tells you whether a password appears in known breaches; it is hashed in your browser, so the password itself is never sent. And the cybersecurity score asks 12 yes or no questions about MFA, patching, endpoint protection, backups and training and returns a score out of 100 with what to fix first.
The fixes, in the order we would make them
1. Give everyone one rule about IT
IT will never ask you to sign in through a link sent in Teams chat, a text or an unexpected email, and will never ask for remote access without a ticket you can confirm. If anyone claiming to be IT calls or messages, hang up and call your IT provider back on the number you already have. Tell staff about the warning sign Arctic Wolf describes: a sudden flood of junk email followed by a friendly offer of help. Put it in writing, say it out loud at the next staff meeting, and keep it fresh with short, regular security awareness training. Our guide to social engineering has more examples to share.
2. Close the Teams door and the remote tool door
Limit Teams external access to the outside companies you actually work with, such as co-counsel and key vendors, instead of allowing every Teams user in the world. Then remove or block Quick Assist and any remote access tool your IT provider does not use, so a talked-into session has nothing to run on.
3. Put limits on where a sign-in can come from
Require MFA for all users and all apps through Conditional Access, block the device code sign-in flow unless you truly need it, and turn off the setting that lets users approve new apps on their own. These are the steps Huntress recommends. Our guide to Conditional Access policies walks through the first five to set up.
4. Upgrade MFA for the people who matter most
Move partners, the managing partner, anyone who approves payments or payroll, and every admin account to passkeys or hardware security keys first. A handful of people with phishing resistant MFA closes the gap that relay pages depend on.
5. Hunt now, and respond the right way
This campaign ran for months before it was published, so look now. Check the device list for computers you do not recognize, review each person's registered MFA methods, and look for inbox rules with odd names or rules that move mail into RSS Feeds. If you find something, revoke all sessions for that account, then remove the extra devices and MFA methods, then reset the password. A reset alone is not enough.
6. Protect the money
Any change to payroll, direct deposit, wiring or settlement instructions should be confirmed by a phone call to a number already on file, never by replying to the email that asked for it. That one habit would have stopped the payroll scheme Huntress described. If money does go out, the FBI's report says time is of the essence: call your bank immediately to request a recall and file a complaint at ic3.gov.
7. Lock down your domain
Set up SPF, DKIM and DMARC so criminals cannot easily send mail as your firm, and watch for lookalike domains. Managed email security filtering adds another layer by catching many lure emails before anyone sees them.
How GlobeVM helps LA law firms and small businesses
GlobeVM was founded in 1996, and today we have "75+ organizations supported across Southern California," including law firms. The protections in this article are not extras. In our words: "Every client gets firewall management, endpoint protection, email filtering, and MFA as part of the plan, not as an add-on." Our promise on response is short: "15 min response time, around the clock."
That matters on a day like the ones in this story, because the first minutes decide how far an attacker gets. "When you call GlobeVM, you reach George or Nazy directly. Not a ticket queue. Not a call center overseas." And "We proudly serve LA's Persian business community in both languages," English and Farsi.
If you are not sure whether your Microsoft 365 would stop a stolen session, or whether your staff would hang up on a fake IT call, book a free IT assessment. We will review your sign-in rules, MFA methods, Teams settings and email setup with you and tell you plainly what to fix first.