Bec

Attackers who compromise accounts and register unauthorized MFA devices often delete the resulting notification emails to evade detection, a technique monitored via Microsoft 365 Exchange audit logs.

Threat actors are suppressing evidence of account compromise by receiving and then hard-deleting emails related to sensitive banking, payroll, or credential changes within Office 365 environments.

EvilTokens is a Phishing-as-a-Service (PhaaS) platform operated by threat actor Storm-2992 that facilitates adversary-in-the-middle (AiTM) attacks by abusing OAuth device code authentication flows to compromise user accounts.

Threat actors are executing a massive business email compromise campaign utilizing AI-generated templates and layered social engineering to deceive finance departments into initiating fraudulent ACH payments.

This analytic detects the creation of suspicious mailbox rules in Office 365, a common technique used in Business Email Compromise (BEC) to hide emails by identifying rules with short or nonsensical names, marking emails as read, or moving them to specific folders.

In Q1 2026, email threats increased, including credential phishing, QR code phishing, and CAPTCHA-gated campaigns, with Microsoft's disruption of the Tycoon2FA phishing platform leading to a 15% volume decrease and shifts in threat actor tactics; BEC activity remained prevalent at 10.7 million attacks.

Attackers are leveraging AI to rapidly reconnoiter and tailor content for smaller organizations, making it easier to execute business email compromise (BEC) scams and scam smaller sums from many victims, as demonstrated by a recent attack targeting a small community organization.

This analytic detects suspicious Office 365 mailbox rule creation, a common technique used in Business Email Compromise (BEC), by scoring rule attributes like short names, marking emails as read, and moving emails to specific folders.