Dental practice BEC and mailbox-rule wire fraud: a scenario walkthrough

This is a scenario walkthrough, not a client engagement summary. The narrative below is a composite drawn from patterns Obsidian Ridge sees across small dental practices; no single client is described, and specific dollar amounts, timing, and operational details have been chosen to illustrate the mechanism rather than to identify any real office. The threat-actor techniques described — adversary-in-the-middle session-token theft and mailbox-rule wire-fraud staging — are documented in the 2024–2025 Coveware quarterlies, the Sophos State of Ransomware in Healthcare 2024 report, FBI IC3 BEC public service announcements, and HHS OCR breach disclosures.

The setup

Assume a small single-location dental practice on Microsoft 365 Business Premium with Dentrix on a local server. An office manager handles billing, lab orders, and most vendor payments — the usual single-point-of-trust arrangement in a small dental office. The practice has been running Obsidian Ridge's Protected tier — MDR, Managed ITDR, and security awareness training — for a few months. That prior decision is what makes the rest of this walkthrough possible.

The phish and what actually gets stolen

The office manager receives an email styled as an ADA membership renewal and clicks through to what looks like a clean Adobe sign-in page. She enters her M365 password, approves the Authenticator push, and the page redirects to a generic landing. Nothing feels wrong.

The page is an adversary-in-the-middle proxy — the EvilProxy family being the best-documented, with Tycoon and Mamba 2FA in the same category — that captures both her password and the post-MFA session token. Within seconds the kit replays that token from a foreign IP and signs in as her, fully authenticated, no second prompt. The distinction that matters here is what got taken. The password is only half of it. The stolen artifact is the session cookie the tenant issued after MFA succeeded, and that cookie is treated by Microsoft 365 as proof the login already passed every check. A password reset alone will not stop the attacker while that cookie is alive.

The mailbox rule that gives the attack pattern away

The attacker then does the thing that gives this attack pattern away. A mailbox rule is created:

• Match on any message containing wire, ACH, routing, or account number.
• Forward externally to a throwaway address.
• Mark as read and move out of the inbox into a low-visibility folder.

That rule is a well-known wire-fraud staging signature. Within about eleven minutes, Managed ITDR fires three correlated alerts: an impossible-travel sign-in, an anomalous mailbox rule matching the wire-fraud keyword family, and an OAuth consent grant to an unrecognized third-party application. The office manager is still seeing patients between appointments. She does not know any of this has happened.

The response, in the order it has to happen

The 24/7 SOC revokes the active session and disables the OAuth consent grant as the first containment step — kill the stolen cookie, because a password reset alone does not. Obsidian Ridge's on-call analyst is on the phone with the practice owner within minutes.

The malicious mailbox rule is preserved for forensic capture, then removed. The password is force-rotated, MFA is re-registered to a fresh authenticator profile, and every active session across every device is revoked in a single sweep. A short review through the Unified Audit Log and Entra sign-in logs confirms the scope: no patient records accessed, no other mailboxes touched, no outbound mail sent. The attacker set the trap and never got to spring it. Sitting in the office manager's inbox is the dental lab's monthly invoice — the wire the rule was built to redirect.

The outcome and what it saved

• The lab payment proceeds normally a few days later, sent to the correct account after an out-of-band callback.
• No patient records are exfiltrated, and the HIPAA Breach Notification Rule is not triggered.
• The forensic record — the mailbox rule, the sign-in trail, the containment actions — is packaged for the cyber-insurance carrier as a documented near-miss with controls operating as intended. That is the kind of file underwriters favor at a renewal review.

The controls that mattered, in order

1. Mailbox-rule anomaly detection tuned for the BEC keyword family. The wire / ACH / routing pattern is a documented wire-fraud staging signature and the detection fires within minutes of rule creation, not after the wire moves.
2. A 24/7 SOC plus an on-call analyst on our team. The owner does not have to interpret an alert during patient care. Someone else reads it, contains it, and calls.
3. Session-token revocation as the first move, not a password reset. AiTM attackers hold a cookie, not a credential. Killing the cookie is what actually breaks their access.
4. Audit-log preservation before rule deletion. Forensics first, cleanup second. The insurance and audit file needs the evidence intact.
5. A pre-existing relationship. The on-call number is already in the office manager's phone before the incident, not looked up after.

What did not save the day

MFA did not save the day, and the office manager did not fail. AiTM kits like EvilProxy, Tycoon, and Mamba 2FA are designed specifically to bypass MFA by stealing the post-authentication session token. Once that cookie is replayed the tenant treats the attacker as fully authenticated. Detection at the identity-behavior layer is what catches this. MFA is necessary; it is not the finish line.

What a practice changes after seeing this pattern

• Out-of-band callback verification for any payment-instruction change, no exceptions — even from a vendor the practice has worked with for years.
• A focused twenty-minute SAT module on payment-redirect themes for the office manager and bookkeeper.
• A short quarterly tabletop added to the cyber-insurance renewal file.

Where to go from here

If you run a dental practice and want to know what a Protected-tier managed program actually does on the afternoon a phish lands, start at the dental practice page or read The Briefing for weekly write-ups of patterns like this. The mechanism generalizes — the vendor names, the mailbox-rule keywords, and the audit-log pattern show up the same way across the SMB market.