# One MSP, Three Microsoft 365 Compromises, 72 Hours

Three Microsoft 365 accounts at an MSP's clients were compromised; attackers created inbox rules moving mail to RSS Feeds/Conversation History to hide invoice fraud and data theft.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2023-06-27
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/one-msp-three-microsoft-365-compromises-72-hours
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-one-msp-three-microsoft-365-compromises-72-hours
- Tags: area:cloud domain:cloud impact:ato impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high tech:azure technique:recon vuln:auth-bypass

**Target:** Microsoft 365 mailboxes and Azure permissions
**Root cause:** Compromised credentials (one account lacked mandatory 2FA) let attackers authenticate from anomalous locations and create inbox rules that redirect victim email into unused folders, hiding the compromise.
**Steps:**
1. Attacker logs into victim M365 account from anomalous IPs (Michigan and New York) with distinct User Agents.
2. Create inbox rule named `...` redirecting mail from a specific employee of a national auto insurance company into RSS Feeds folder.
3. Second victim: create rule `xx` with no parameters other than name and move-to folder (RSS Feeds), sending all mail there.
4. Third victim: account with full admin permissions assigns itself privileges granting full access to other users' mailboxes.
5. Create rules pushing mail from construction and car rental companies into Conversation History folder for invoice manipulation.
**How found:** Huntress ITDR correlated anomalous sign-in geolocations and distinct User Agents with newly created inbox rules moving mail to RSS Feeds/Conversation History, flagging the rule manipulation as malicious.
**Exploitation:** Using stolen credentials, attackers logged in from proxy IPs, created hidden inbox rules to suppress legitimate invoices and notifications, then planned to substitute spoofed invoices directing payment to attacker-controlled bank accounts; admin account also granted mailbox access to other users.
**Escalation:** Third incident escalated from a single compromised account with full administrative permissions to self-assigned permissions over multiple employees' mailboxes, widening the BEC blast radius.
**Insight:** Pivot on inbox-rule creation events joined to sign-in geolocation/User-Agent anomalies; rules with only a name and a move-to folder (RSS Feeds, Conversation History, Deleted Items) are strong BEC indicators, especially when targeting mail from insurers, vendors or rental companies tied to invoicing.