Throughout 2025 and into early 2026, threat actors shifted from stealing credentials to fully hijacking employee identities by exploiting help-desk trust, resetting MFA factors, and registering attacker-controlled devices under legitimate accounts. Microsoft 365 Direct Send misconfigurations allowed spoofed internal email to bypass filtering, enabling social engineering at scale against finance and payroll workflows. Organizations face direct financial loss through fraudulent wire transfers and payroll redirection, compounded by prolonged attacker persistence via legitimate remote management tools that evade standard detection.