Real alerts. Real verdicts.
Written by the agent that worked them.

An attacker used a stolen session token to access a director's Exchange mailbox from an anonymous proxy IP, executing 81 operations including a covert inbox rule designed to intercept emails from specific external contacts. Administrator confirmation and HIBP breach data corroborate the account compromise.

A hardware engineering technologist's account was compromised via phishing on February 19, leading to spam email sending, 30 DLP policy violations involving sensitive technical specifications, and Bearfoos malware execution on February 20. Microsoft Defender blocked the malware, but prior data access attempts indicate successful unauthorized access to engineering intellectual property.

Analysis of Okta authentication logs reveals account user_1 was compromised and used to access Alpha from 16 successful logins across 7 countries via VPN, with 81.25% flagged as high-risk and physically impossible travel patterns detected.