# Town of Whitsett, NC Microsoft 365 Account Compromise Used to Send Fake Payment Phishing Email

> The Town of Whitsett, NC had its town hall Microsoft 365 account compromised and used to send a fraudulent email titled "Ref: Approved Payment Report from Whitsett, NC" carrying two attachments and a document password, under the town administrator's signature. The town's IT provider, Brooks Networking, secured the accounts and reset passwords.

- **Published:** 2026-11-01T18:19:11Z
- **Last reviewed:** 2026-11-01T18:19:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5026
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5026.png
- **ID:** TL-2026-5026
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 5

## Description

On or about 2026-10-22 (approximately 10 a.m.), town officials in Whitsett, eastern Guilford County, North Carolina, learned that the Microsoft 365 account used by Whitsett Town Hall had been accessed without authorization and used to send a fraudulent email. The message bore the subject "Ref: Approved Payment Report from Whitsett, NC", used the town administrator's email signature, included two attachments, and supplied a password for the attached document. The number of recipients has not been publicly reported.

The incident is a compromised-account abuse case, not a Microsoft 365 product vulnerability: no CVE, malware family, threat actor, infrastructure, file name, hash, URL or domain has been disclosed. The initial access method (credential phishing, password reuse, token theft, etc.) is not stated in the available reporting and is not asserted here. Because the mail originated from a legitimate tenant account, it would be expected to pass SPF/DKIM/DMARC for the town's domain and appear trustworthy to recipients; the secondary report also cites an Oklahoma Municipal Assurance Group (OMAG) 2021 bulletin on the same pattern, which stresses the absence of the usual tells such as poor grammar or unrecognized sender addresses because the mail comes from a hacked legitimate user account. A password supplied alongside an attachment is a pattern commonly used to hinder automated attachment scanning, though the reporting does not state the attachments' contents or purpose.

Response, per the secondary report and the WXII account it relays: Brooks Networking secured the affected accounts, passwords and the Microsoft account for town administration and town hall; the town contacted recipients by phone and posted a social media notice. Recipients were advised not to open attachments, use the supplied password, click links or reply, not to disclose payment information or credentials, to change exposed passwords immediately, to monitor financial statements and credit reports, and to verify payment requests through previously known phone numbers. Whether data was accessed or stolen, whether any financial loss occurred, and the specific remediation steps taken by Brooks Networking have not been publicly reported.

Defensive value: the case illustrates the Microsoft guidance for compromised accounts - disable or reset the account, revoke sessions and refresh tokens (Revoke-MgUserSignInSession), review MFA methods, app consents and admin roles, and hunt for malicious inbox rules and mailbox forwarding (Get-InboxRule -IncludeHidden, Get-Mailbox Forwarding*), then review Entra sign-in logs, the Unified Audit Log and message trace for the abuse window. Sourcing caveat: the primary assigned source (databreaches.net) returned HTTP 403, and the WXII report could not be retrieved directly (only snippets surfaced via search); facts rest on the WindowsForum secondary report, corroborated by search-result excerpts of the WXII account.

## MITRE ATT&CK

- T1078.004 Cloud Accounts
- T1566.001 Spearphishing Attachment
- T1586.002 Email Accounts
- T1684.001 Impersonation
- T1204.002 Malicious File

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake 'Approved Payment Report' Lure Sent From Internal Account (Whitsett BEC)** (`TL-2026-5026-SPL-001`)

Detects outbound mail whose subject matches the Whitsett, NC lure 'Ref: Approved Payment Report from Whitsett, NC' or its generalised 'Ref: ... payment/remittance ... report' form, sent from a tenant mailbox to external recipients. The Whitsett message came from a legitimately compromised Microsoft 365 account, so it would pass SPF/DKIM/DMARC; subject and sender-to-recipient domain behaviour are therefore the reliable signals. Covers the exploitation phase (TL-2026-5026, T1566.001 / T1586.002 / T1656 / T1204.002).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1586.002, T1656, T1204.002
- **Data sources:** o365:reporting:messagetrace, EmailEvents, EmailAttachmentInfo, microsoft365defender emailevents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=o365 sourcetype="o365:reporting:messagetrace" earliest=-24h ```TL-2026-5026 fake payment report lure from compromised internal account```
| eval subj=lower(Subject), sender_domain=lower(mvindex(split(SenderAddress,"@"),1)), recipient_domain=lower(mvindex(split(RecipientAddress,"@"),1))
| where sender_domain!=recipient_domain
| where like(subj,"%approved payment report%") OR match(subj,"^ref:[ ]*.*(payment|remittance).*report")
| stats count AS messages dc(RecipientAddress) AS recipients values(Subject) AS subjects min(_time) AS first_seen max(_time) AS last_seen BY SenderAddress
| convert ctime(first_seen) ctime(last_seen)
| sort - recipients
````

### Microsoft KQL

```kql
EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == "Outbound"
| where Subject has "Approved Payment Report" or Subject matches regex "(?i)^ref:[ ]*.*(payment|remittance).*report"
| join kind=leftouter (EmailAttachmentInfo | where Timestamp > ago(24h) | summarize AttachmentFiles=dcount(SHA256), FileNames=make_set(FileName, 10) by NetworkMessageId) on NetworkMessageId
| project Timestamp, SenderFromAddress, SenderIPv4, RecipientEmailAddress, Subject, AttachmentCount, AttachmentFiles, FileNames, DeliveryAction, NetworkMessageId
```

### Sigma

```yaml
title: Fake Payment Report Lure Sent From Internal Mail Account (TL-2026-5026)
id: 6b0c1a52-3f4e-4d7a-9c1e-5a2d8e7f0b11
status: experimental
description: Detects outbound email whose subject matches the Whitsett NC fake payment lure ('Ref: Approved Payment Report from Whitsett, NC') or a generalised Ref/payment/report pattern, indicative of a compromised Microsoft 365 account used to send phishing.
references:
    - https://windowsforum.com/news/whitsett-town-hall-microsoft-365-account-compromised-in-fake-payment-email.450108/
    - https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/01
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.resource-development
    - attack.t1586.002
    - attack.defense-evasion
    - attack.t1656
    - attack.execution
    - attack.t1204.002
logsource:
    product: microsoft365defender
    service: emailevents
detection:
    selection_direction:
        EmailDirection: 'Outbound'
    selection_subject_exact:
        Subject|contains: 'Approved Payment Report'
    selection_subject_pattern:
        Subject|re: '(?i)^ref:[ ]*.*(payment|remittance).*report'
    condition: selection_direction and 1 of selection_subject_*
falsepositives:
    - Legitimate accounts-payable remittance notices that use a 'Ref:' prefix
    - Security awareness phishing simulations reusing the lure text
level: high
```

**Known false positives:**

- Legitimate accounts-payable or treasury remittance notices that reuse a 'Ref: ... Payment Report' subject format
- Phishing-awareness simulations that replay the Whitsett lure text

**Tuning notes:** Add your own tenant's legitimate payment-notice senders to an allowlist by SenderAddress. Widen the regex with local lure variants seen at other municipalities. The Splunk message-trace sourcetype requires the Splunk Add-on for Microsoft Office 365 reporting input; adjust index/sourcetype to your deployment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Risky Or New-Country Successful Entra Sign-In (Cloud Account Takeover) (locked: unlock with TL Creds)
- Mailbox SMTP Forwarding Added Via Set-Mailbox (locked: unlock with TL Creds)
- Multi-Attachment Outbound Mail From Account With Risky Or Legacy-Auth Sign-In (locked: unlock with TL Creds)
- Successful Legacy-Protocol Sign-In to [indicator] (MFA-Bypass Path) (locked: unlock with TL Creds)
- MFA Method Registration, Role Grant or App Consent Change (Account Persistence) (locked: unlock with TL Creds)
- Mail Sent As Or On Behalf Of Another Mailbox (Executive Signature Impersonation) (locked: unlock with TL Creds)
- Malicious Inbox Rule Created With Forward/Redirect/Delete Actions (Post-Compromise Hiding) (locked: unlock with TL Creds)
- Burst of External Outbound Mail From Single Tenant Account (Compromised Sender Abuse) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Whitsett Town Hall Microsoft 365 account compromised in fake payment email](https://windowsforum.com/news/whitsett-town-hall-microsoft-365-account-compromised-in-fake-payment-email.450108/)
- [Respond to a compromised email account in Microsoft 365 - Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)
- [Revoke user access in an emergency in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)
- [Control automatic external email forwarding in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)
- [Search the audit log in the Microsoft Defender portal](https://learn.microsoft.com/en-us/defender-office-365/audit-log-search-defender-portal)
- [Message trace in the Microsoft Defender portal](https://learn.microsoft.com/en-us/defender-office-365/message-trace-defender-portal)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5026