# Business Email Compromise via Azure Administrative Privileges

Compromised Azure AD global admin account used to create backup admin accounts, grant mailbox delegation, and add hidden inbox rules across many users for BEC.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2023-07-27
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/business-email-compromise-via-azure-administrative-privileges
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-business-email-compromise-via-azure-administrative-privileges
- Tags: area:cloud domain:cloud impact:ato impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:azure technique:recon vuln:account-takeover vuln:misconfiguration vuln:privilege-escalation

**Target:** Azure Active Directory / Microsoft 365 mailboxes
**Root cause:** A global administrator account was compromised (no MFA enforced), letting the attacker reset passwords and grant admin privileges to dormant accounts, then delegate mailbox access and inject inbox rules.
**Steps:**
1. Attacker logs into compromised Azure AD global admin account from Lagos, Nigeria.
2. Reset credentials of a rarely used account and grant it full admin privileges (Account 2).
3. Assign licenses to Account 2 using the original admin account to obtain desired permissions.
4. Grant permission to view user inboxes and send on behalf of users in large batches.
5. Add inbox rules on behalf of users moving mail from a legitimate-looking domain to Conversation History and marking as read.
6. Modify rules to forward to attacker Gmail and AOL addresses.
7. After admin resets Account 1, attacker returns via Account 2, creates Account 3 the same way, and after the admin disables Account 3, attacker returns via Account 2, resets Account 3's password and re-enables it.
**How found:** SOC analyst reviewing M365 activity noticed several suspicious inbox rules added across multiple users in rapid succession, all on behalf of users by one Azure admin logging in from Lagos, Nigeria.
**Exploitation:** Attacker with global admin used password resets and role grants to build redundant admin accounts, then delegated mailbox access and planted inbox rules to silently read and forward victim email, persisting through remediation by cycling between backup admin accounts.
**Escalation:** Created multiple backup admin accounts (Account 2, Account 3) so access survived credential resets and account disabling by the legitimate admin.
**Insight:** Inbox rules created 'on behalf of' users by an admin are a strong BEC signal; also audit dormant accounts that suddenly gain admin roles and licenses, since attackers use them as redundant persistence.