Cyberattack via supplier: How hackers bypass MFA and steal access
What is a supply chain attack via email? A supply chain attack via email involves attackers first hacking a supplier or partner, then using their account to send file shares that trick employees into logging into fake pages. The attack often bypasses MFA through a technique called AiTM (Adversary-in-the-Middle).
How does a supply chain attack via email work?
The attack thus starts with an external party. It could be your accounting consultant, marketing agency or another supplier who has access to documents or other shared communication.
When the external account is hacked, it is used to share files via e.g. SharePoint, OneDrive, Dropbox or similar. What makes this approach so effective is that the notifications are often genuine and come from legitimate senders. The document is often customised with filenames like "Updated contract" or "Project plan". An employee is asked to log in to view the file and in this way grants access even with MFA activated.
"When criminals combine automation with modern AI tools, they can carry out attacks that previously would have required many hours of manual work. Now they analyse email history, understand relationships and generate credible files and filenames in seconds. With these tools, they attack everything and everyone, all the time," says Gaute Meland, Senior IT Operations Consultant, Nordlo Bergen
Why MFA isn't always enough
When the user logs in to view the file, the critical moment occurs: the attacker copies the session information in real time. For the employee, the login looks completely normal, even with two-factor authentication enabled. The attacker takes over a valid session and gains the same access as the user.
"AiTM does not undermine MFA itself; it exploits the fact that the user trusts a login window that looks completely genuine. As long as we have to be able to log in somewhere, there will always be a way in for attackers. Therefore, technical measures must be combined with training," continues Gaute Meland.
Consequences of a Successful Supply Chain Attack
When attackers have a valid session, they can read and send emails in the user's name, set up hidden forwarding rules, change payment information in ongoing transactions, and use the account to spread the attack further, both internally and to your customers and partners.
The activity often resembles legitimate use, which also means it can take weeks before someone discovers the intrusion. The longer the attacker has access, the greater the damage.
How to Protect Your Company Against Supply Chain Attacks
The defence must be twofold, both human and technical.
Training and Awareness:
On the human side, it's about creating a culture where employees dare to question what they see on the screen. This requires training and an open environment. Show concrete examples of how attacks can look and how they can verify unexpected sharing when suspecting intrusion attempts.
Technical Measures:
On the technical side, there are several layers that together create stronger protection.
- Risk-based account protection. Automatically reacts to unusual logins from unexpected locations, unknown devices or at unusual times.
- Disable legacy authentication. Old login methods often lack support for MFA and are a common way in for attackers.
- Restrict external sharing. Require extra approval for sensitive files and ensure employees only have access to what they need.
- Ongoing monitoring. Monitor email rules, account behaviour and login activity, and have effective incident management in place.
"Many organisations already have security functionalities they do not fully utilise. When good technical measures are combined with employees who know what to look for, you are much stronger against this kind of attack," concludes Gaute Meland.
We Help You Secure the Supply Chain
Nordlo can map your vulnerabilities and deliver a prioritised action plan, from technical setup to ongoing monitoring and training of employees.
5 common questions and answers about cyberattacks we supplier
- What is a supply chain attack?
A supply chain attack involves attackers entering your organisation by first compromising one of your suppliers, partners, or other trusted external party. - What does AiTM (Adversary-in-the-Middle) mean?
AiTM is an attack technique where the attacker positions themselves between the user and the service to capture login credentials and session information in real-time, even when MFA is enabled. - Why does MFA not protect against AiTM attacks?
MFA protects against stolen passwords, but AiTM captures the entire session after the user has logged in. The attacker thus obtains a valid session without needing the password or one-time code. - How do I know if our company has been affected?
Common signs are unexpected forwards in the mailbox, logins from unusual locations, or contacts reporting strange emails from you. Ongoing monitoring is crucial for early detection. - What is the most important thing we can do to protect ourselves?
Combine technical measures, such as risk-based account protection, restricted external sharing, and monitoring, with regular training that shows concrete examples of what the attacks look like.
Cyberattack via supplier: How hackers bypass MFA and steal access
Download interview
