How attackers hack Microsoft 365

By the QuantumSec team

Understanding how Microsoft 365 is attacked is the first step to defending it. Most compromises don't exploit a Microsoft flaw, but the organization's configuration and behavior. These are the vectors we see again and again in audits and incident response.

AiTM phishing and token theft

Modern adversary-in-the-middle (AiTM) phishing campaigns don't just steal the password: they capture the session cookie and token, which lets them bypass MFA. With the stolen token, the attacker accesses email and files as if they were the legitimate user, without re-authenticating.

Illicit OAuth app consent

Instead of stealing credentials, the attacker tricks the user into granting consent to a malicious OAuth app with permissions over email and files. Access persists via a token even if the password is changed, and it bypasses MFA. It's one of the most effective and least controlled vectors.

Exchange persistence and Entra ID abuse

After gaining access, the attacker creates forwarding rules in Exchange Online to monitor email, and abuses Entra ID: registering new app registrations with their own credentials, adding permissions or manipulating federation to keep long-term access, even if the original account is reset.

How this is stopped

Defense combines phishing-resistant MFA (FIDO2/passkeys), conditional access that blocks legacy authentication, strict app consent control, monitoring of Exchange rules and new app registrations, and logging with alerts. A periodic audit verifies that these defenses actually work.

FAQ

If I change the password, do I lock the attacker out?

Not necessarily. Stolen session tokens, OAuth app consents, forwarding rules and credentials added to app registrations can keep access. After an incident you must revoke tokens and sessions, review consents and rules, and audit Entra ID.

Does MFA protect me from everything?

Phishing-resistant MFA is essential, but AiTM phishing can steal the session and illicit consent doesn't require the password. That's why you need to harden conditional access, control apps and audit the environment.