Anatomy of a Phishing Email: M365 MFA Bypass

We received a real phishing email at Monolith Forensics, so we decided to dig into it deeper. In this session, we’ll walk through the anatomy of a phishing email. Using the email we received as a case study, we’ll examine the headers, sender infrastructure, and body content to see what gave it away and how it bypassed M365 MFA.

Speaker

Matt Danner, Founder & CEO

Matt Danner is the Founder & CEO of Monolith Forensics, where he leads the team that develops Monolith - a case, evidence, and analysis management platform designed for digital forensics, eDiscovery, and incident response teams. With over a decade of hands-on experience in DFIR, Matt has worked in both the public and private sectors as a forensic examiner, investigator, and senior consultant, providing expert services in digital forensics, incident response, eDiscovery, expert testimony, and forensic reporting. He regularly presents on modern investigative techniques and best practices, blending traditional forensic methodology with developer-style tools and workflows to help practitioners solve complex cases more efficiently.