Phishing attack example
A typical phishing attack in the Netherlands in 2026 starts with an email that looks like a legitimate message from Microsoft, ING, PostNL, or the Belastingdienst. It asks the recipient to verify an account, track a package, or review an invoice, and links to a lookalike login page on a domain that resembles the real one. The recipient enters their credentials; the attacker captures username and password and relays them within seconds to the genuine service to capture the multi-factor code. Within minutes, the attacker has full access to the account. The sections below walk through a realistic Dutch BEC case from first email to lessons learned, so the pattern is recognisable before it reaches your inbox.
Stage one: the phishing email
The email arrives at 16:47 on a Friday, a common timing because people are tired, distracted, and unlikely to verify carefully before the weekend. The subject line reads 'Actie vereist: uw Microsoft 365-wachtwoord verloopt vandaag'. The sender address is 'security@microsoft-365-services.com', a domain registered three days earlier. The body is in fluent Dutch, uses the recipient's name, and includes a button that links to 'login-microsoftonline.com', a typosquatted domain.
The email passes SPF and DKIM because the attacker-controlled domain has proper DNS records. Traditional email filters do not block it: on paper it looks legitimate.
Stage two: credential capture
The recipient clicks the button. The page that loads is a pixel-perfect copy of the Microsoft login page, served over HTTPS with a valid certificate. When the recipient enters their email and password, the attacker's server submits the same credentials to the real login.microsoftonline.com in the background. Microsoft sends an MFA prompt to the recipient's phone. The attacker's page asks for the code. The recipient enters it. The attacker captures the session cookie, which is valid for days, and the MFA prompt is defeated in seconds.
This is called adversary-in-the-middle (AiTM) phishing, and it is the dominant technique against MFA-protected accounts in 2026.
Stage three: persistence
Once inside the mailbox, the attacker sets an inbox rule that forwards all messages containing words like 'factuur', 'bank', or 'wachtwoord' to an external address and marks them as read. A second rule hides replies to the attacker's outbound phishing from the user's view. The attacker also adds an OAuth-authorised mail app with full mailbox access, so that even if the password is changed, access persists.
This stage takes two minutes. The user has no indication anything is wrong.
Stage four: the business email compromise
Over the next ten days, the attacker reads emails, spots ongoing transactions, and studies the writing style of the compromised user. When a legitimate invoice from a real supplier arrives, the attacker intercepts it, swaps the bank account number for one they control, and forwards the modified invoice to the finance department from the user's own account. The mail comes from the expected sender and references a real, ongoing deal; finance pays without question.
According to Dutch police fraud reports, a mid-market Dutch company in this scenario loses between 20,000 and 500,000 euros per transaction.
Lessons and response
Three controls would have broken this chain. Phishing-resistant MFA (hardware tokens or certificate-based authentication) defeats AiTM capture. Conditional access policies that block logins from new devices or unusual locations catch the attacker's initial access. Automated detection of inbox forwarding rules flags stage three before financial loss occurs.
If you recognise this pattern in your own inbox or your finance team's records, the response path is [phishing incident response](/phishing-incident-response) within the first hour. Full recovery requires revoking OAuth tokens, clearing forwarding rules, rotating credentials, and auditing every outbound message sent during the attacker's access window.
Discuss this with a senior responder.
Discuss this with a senior responderNeed incident response?
- Two-hour SLA
- Dutch senior responders