A Microsoft 365 tenant compromised through business email compromise: malicious inbox rules, an OAuth consent grant and token theft, contained and hardened

A professional services firm found out about its compromise from a customer, who questioned a request to change bank details. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. The first call was to us, and the first instruction was to preserve evidence and avoid deleting anything.

The pattern was a common one. An employee had followed a link in a message that looked like a shared document and signed in on a lookalike page that relayed the login to Microsoft in real time. Because the relay captured the session token after multi-factor authentication was satisfied, the attacker did not need the password again. Ordinary SMS or app-code multi-factor authentication does not stop this; sign-in methods bound to the real site, such as passkeys and FIDO2 security keys, do.

Containment came first. Our team reset the password, revoked every session and refresh token for the account, and removed authentication methods and devices the attacker had added. Then came the part that is easy to miss: inbox rules that hid replies from the finance team and forwarded copies outside, and an OAuth app that the user had been tricked into consenting to, which would have kept access after a password reset. Both were removed, and the app's consent was revoked tenant-wide.

Log review answered the owner's questions. Sign-in logs, audit events and message trace showed when the attacker arrived, which mailboxes were read, and which messages were sent, so the firm's counsel could decide whom to notify instead of guessing. The finance team confirmed the payment request through a callback to a known number, so no money moved. Anyone who may have paid a similar request is told to contact their bank and law enforcement at once.

Hardening followed in order of risk. Conditional Access now requires phishing-resistant sign-in for administrators and finance staff, then for everyone, blocks legacy authentication and requires admin approval for new app consent. Defender for Office 365 policies cover impersonation and alert on new inbox rules and external forwarding, and staff training uses the real message as a lesson. This is the work our team does under cybersecurity and Microsoft Exchange services; it reduces the chance and the damage of a repeat, and it is not a guarantee.