What happened
- On July 20, 2021, Microsoft's Digital Crimes Unit took action under a court order in the Eastern District of Virginia.
- It gained control of 17 homoglyph domains (example: MICR0S0FT.COM) used in BEC.
- Victims were mostly small businesses in North America.
- Criminals used stolen credentials to read real payment threads and then sent near-identical emails from lookalike domains.
- Microsoft said: "The only difference between the genuine communication and the imposter communication was a single letter changed in the mail exchange domain."
Source note: the source used here is a secondary report by Security Affairs. Microsoft's own announcement is the primary source.
Root cause, per the sources
Per the report, stolen credentials gave access to real payment threads, and lookalike domains were then used to continue the conversation.
The exposure behind it
A registered domain that differs from yours by one character can send email that looks right at a glance. Whether such domains exist is public information.
What PixelPrivate can check
Brand Shield
We find registered lookalikes of your domain, shown as "Possible lookalike domain" findings for you to review.
Learn moreMicrosoft 365 connector (new)New
Reports indicators in your tenant, such as external-forwarding rules, for review.
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We cannot prove the intent of a lookalike domain, and we do not take domains down.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- Look at the lookalikes of your domain and decide which are yours.
- Tell staff that a changed sender domain, even by one letter, is a reason to call back.
- Consider registering the most obvious variants of your own domain.
- Reset passwords for any account you suspect was exposed.
Sources
- Security Affairs (secondary source), “Microsoft took down domains used in BEC campaign”, July 2021. https://securityaffairs.com/120334/cyber-crime/microsoft-bec-campaign.html(secondary source)
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
Is this the primary source?
No. It is a secondary report. Microsoft's own announcement is the primary source.
Will PixelPrivate take lookalike domains down?
No. It finds registered lookalikes of your domain. It cannot prove intent and does not take domains down.
Who were the victims?
The report says victims were mostly small businesses in North America.