The investment firm was not hacked through its trading platform, no cryptocurrency exchange was compromised and no sophisticated financial system was breached. The attackers compromised Microsoft 365, quietly took control of the conversation and let the firm authorise the payment itself.
