Hi,
I received an email that was send to me by a stranger (using an unknown domain) but bearing a signature of my colleague. Is like an email being forwarded (or probably simulate through copy paste from the original mail) to me imitating my colleague. And the email is having an attachment infected with Trojan.
The concern is the content of the email (send by the stranger) was an exact email exchange a week ago between a group of colleagues including myself in the email.
I started investigating but did not see any "Risky sign-in" or "Risky users" reported under Azure Active Directory admin console. But one thing for sure is that person has got hold of the email exchange.
Few thing crosses my mind:
1) Assuming one of the colleague account has got compromised, then this should show under "Risky sign-in", if the person is signing in from another location. But no alert generated.
2) Assuming the account is not compromised, is there a possibility whereby the outgoing/incoming mails is being "mirrored"/"monitored"? Is there anyway to investigate this scenario?
Any advice?
Thanks.
