City employees click a fake timesheet-correction message that harvests Microsoft 365 passwords. What is the attack vector?
Select an answer to reveal the explanation.
Short Explanation
This one walked in through the inbox, not through a pump-house PLC. A fake timesheet note that steals Microsoft 365 passwords is classic email phishing. Do not drag OT gear into a mail lure just because the city also has a water plant.
Full Explanation
City employees clicking a fake timesheet-correction message that harvests Microsoft 365 passwords are hit by email phishing that delivers a credential-harvest lure. The attack vector is the inbox lure, not OT gear the city also happens to own. Civic identity theft often begins with ordinary-looking HR or payroll mail, and Enterprise Security email plus authentication telemetry should be framed that way for responders and leadership.
Calling it a PLC exploit on the water-treatment plant fails by concept: the stem is mail credential harvest, not industrial control exploitation. Calling it a supply-chain compromise of the parking-meter vendor fails by concept: no trusted vendor update path is described. Calling it an internet-exposed SCADA historian fails by concept: the delivery path is email, not an exposed historian interface.
Exam caveat: Match the vector to the delivery path in the stem—fake mail plus credential harvest equals phishing, even if the municipality also runs OT systems.
Operational check: Hunt the lure domains and failed or successful M365 logons, disable malicious mail rules if present, reset affected accounts with MFA review, and avoid opening unrelated OT incident tracks without supporting evidence.