Re: What was the attack vector?
We go one further than that, and match the from message headers 'Display Name' to the display name of any internal 365 recipient with an even bigger, red shouty banner.
If you manage to ignore that, then it should be a P45 generating event.
Biting the hand that feeds IT
