The Buyer Who Told Sales to Expect a Password Prompt

The attacker never sent a link. It sent a stage direction: "Kindly sign in to your Microsoft account and enter your password when prompted."

The target was a regional key-account sales engineer at a US industrial electronic-connector manufacturer. The attacker played the customer, a project manager at a real construction firm asking about a connector part, and let the rep do the chasing.

That inversion is the whole play. Most supply-chain phishing impersonates a vendor and targets accounts payable. This one impersonated a buyer and targeted the one team whose job is to answer strangers fast.

Sales Wrote First, Twice

The quoted history in the attacker's message shows the rep opening the thread on October 13. It was a textbook intro: happy to support your request, three sizing questions, and an offer of a 30-minute virtual call. On October 15 the rep followed up, copied two colleagues, and proposed a call again.

The attacker's reply on October 16 is the only attacker message in the record. How the original inquiry first reached the rep is not established. What is clear is that this was not a hijacked third-party thread. It was the rep's own good-faith correspondence with a fake persona.

That matters for detection. Every signal a rep uses to judge a prospect (they asked about a real part, I replied, they replied back) was satisfied.

The Script Was the Payload

The reply did three things in a few sentences.

It declined the call: "due to work-related restrictions and my current schedule, I'm not able to participate in Zoom calls at this time." No voice, no video, no live verification.

It claimed a technical specification file had been sent separately via WeTransfer, for the rep to use as a reference for quotes. No WeTransfer message or link appears in this record, so whether one ever arrived is unknown.

Then it pre-loaded the trap. Sign in to Microsoft, enter your password when prompted, and you will see the specification requirements and sample slides. It added pressure: the samples "must, however, precisely match the technical drawings."

Read that sequence as a defender. A file-sharing service has no reason to ask for a Microsoft password. That incongruity is the one thing that should stop a careful person at the login screen. The email defuses it in advance. By the time a prompt appears, the buyer already said it would, and a quote is on the line.

This is credential harvesting engineered around the victim's expectations, not the scanner's blind spots. The harvest page, wherever it lives, was meant to arrive pre-approved.

See Your Risk: Calculate how many threats your SEG is missing

Mapping the Buyer Persona to ATT&CK

• T1598, Phishing for Information: the email solicits a credential entry rather than delivering malware. It sits beside the broader T1566 Phishing family.
• T1583.001, Acquire Infrastructure: Domains: the sender domain was registered on 2026-09-21, 25 days before the reply, with two letters of "group" transposed.
• T1585.002, Establish Accounts: Email Accounts: a Microsoft 365 tenant was stood up on that domain, with Microsoft-hosted DNS.
• T1036.005, Masquerading: Match Legitimate Name: the persona borrows the name of a real construction firm. That firm is an impersonated bystander, with no evidence it was compromised or involved.

Authentication was clean, as it usually is when the attacker owns the domain. SPF, DKIM and DMARC all passed on the lookalike, and Microsoft's outbound filter scored it SCL 1. That is supporting detail here, not the story.

What the Record Shows

The message carried zero links, zero attachments, zero QR codes. The only inline object was a signature image.

Why Sales Teams Are the Soft Target

The 2026 Verizon Data Breach Investigations Report puts the human element in 62% of breaches and credentials in 39% across the full kill chain. Pretexting accounts for 6% of initial access vectors. A fake buyer is pretexting with a commercial incentive attached.

The Microsoft Digital Defense Report 2024 describes identity attacks as the dominant pressure on cloud tenants, and the FBI IC3 2024 report keeps impersonation-driven fraud near the top of reported losses. The IBM Cost of a Data Breach 2024 report tracks stolen credentials as a leading, slow-to-contain entry point.

Sales sits at the intersection. Reps are measured on response speed. They are trained to accommodate a prospect's quirks. A buyer who cannot do calls is an inconvenience, not a red flag, until you see it paired with a password request.

Two Tells Worth Training On

First: a request to enter your password is the indicator by itself. Not the link, not the domain. CISA phishing guidance and the NIST definition of phishing both center the attempt to obtain credentials. An email that tells you a prompt is coming is telling you what the attack is.

Second: a new prospect who refuses a call but insists on a sign-in has the shape of an attack, not a deal. Real buyers with real projects get on the phone to win pricing. This one went out of its way to avoid a voice it could not fake.

How It Was Stopped

There was nothing for a URL or file engine to score. The platform did flag one sender insight, a newly registered return-path domain. The decisive signal came from people: a colleague in the same organization reported the message, and a human analyst resolved it as malicious. The affected mailbox was quarantined.

That is the human element doing what scanners cannot. The IRONSCALES community spans 36,000+ security professionals across 18,000+ organizations, and a single colleague's report is exactly the signal a link-free lure like this cannot hide from. The email had nothing malicious in it. What gave it away was what it asked the rep to do.

If your sales team would comply with this email, the gap is not your filter. It is the assumption that a customer conversation is safe mail. Brief your reps on business email compromise patterns that start with a buyer, not a bill.