AegisAI Perspectives · 013
Token theft is the top Microsoft 365 email threat, then BEC, consent phishing and QR lures. See the order and the setting that closes each one.
Token theft ranks first for Microsoft 365 users: phishing kits such as Kali365 capture OAuth tokens, so the attacker needs no password and meets no MFA prompt2. Business email compromise follows, with 24,768 FBI complaints in 202519.
No public source ranks Microsoft 365 email threats by how often they hit. This order is our judgment: threats that defeat MFA come first, then threats with published losses, then the quiet ones that keep an attacker inside the mailbox. Each threat below comes with the setting that closes it.
The FBI says Kali365 is a phishing-as-a-service platform, first seen in April 2026 and sold mainly through Telegram1. The victim types a code on a real Microsoft page. The attacker then holds the OAuth access and refresh tokens.
Proxy kits do the same job another way. Tycoon 2FA sat between the victim and the sign-in page and captured session cookies, which attackers reused without triggering MFA checks24. Microsoft seized 330 domains tied to it on March 4, 2026. For the mechanics, read how Kali365 defeated MFA without breaking it and how Mirage2FA steals sessions after MFA clears.
The FBI's 2025 report counts 24,768 business email compromise complaints and $3,046,598,558 in reported losses. The 2024 figures were 21,442 complaints and $2,770,151,14620. The same report lists 72,984 phishing and spoofing complaints and $215,843,126 in losses21.
By default every user can consent to apps for permissions that need no administrator approval, such as mailbox access6. A malicious app that wins one click keeps that access until an admin revokes it.
The FBI says QR codes push the victim onto a mobile device, past traditional email security controls, to pages that imitate Microsoft 365 sign-in, among other portals. The chain ends in session token theft and replay22.
After a takeover, an attacker sets Inbox rules that forward mail outside, or that hide messages in folders such as RSS Subscriptions15. Users can create external forwarding rules themselves, deliberately or through a compromised account13. A real intrusion of this kind is covered in the IEH Microsoft 365 mailbox breach.
Direct Send lets a device connect to a tenant's MX endpoint on port 25 with no authentication26. DMARC at p=reject is the control against spoofed senders in business email compromise25. Our report on Direct Send abuse for phishing delivery shows the attack end to end.
Password attacks sit under all six. Microsoft's analysis says more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication9.
In the Entra admin center go to Entra ID, Conditional Access, Policies. Under Conditions, Authentication flows, pick Device code flow, grant Block access, and start in Report-only mode4. Audit current use first and exclude emergency access accounts3.
Use the Require authentication strength control. The Phishing-resistant MFA strength allows Windows Hello for Business and FIDO2 security keys, plus certificate-based authentication11. Authenticator phone sign-in does not qualify12.
Under Enterprise apps, Consent and permissions, User consent settings, allow consent only for verified publishers7. The change affects future consent only, so review and revoke existing grants, and turn on the admin consent workflow8.
Target All users and All resources, set Client apps to Exchange ActiveSync clients and Other clients, and grant Block access, in Report-only first10.
Choose On or Off in the outbound spam policy, never Automatic - System-controlled, because existing organizations can still have forwarding enabled under it14.
Run Set-OrganizationConfig -RejectDirectSend $true. Then move DMARC from p=none to p=quarantine to p=reject.
Revoke-MgUserSignInSession ends all sessions and invalidates refresh tokens16. Check MFA devices an attacker added and the apps that hold consent18.
For a wider walkthrough of tenant hardening, read the Microsoft 365 and Google Workspace email security guide.
| Rank | Threat | Setting that closes it | Where |
|---|---|---|---|
| 1 | Token theft (device code, proxy) | Block device code flow; phishing-resistant MFA strength | Conditional Access |
| 2 | Business email compromise | DMARC p=reject; phishing-resistant MFA for payment approvers | DNS; Conditional Access |
| 3 | OAuth consent phishing | User consent for verified publishers only; admin consent workflow | Enterprise apps |
| 4 | QR-code phishing | Phishing-resistant MFA, so a replayed sign-in still fails | Conditional Access |
| 5 | Hidden inbox rules, forwarding | External forwarding Off; Get-InboxRule -IncludeHidden17 | Outbound spam policy; Exchange Online |
| 6 | Spoofing, Direct Send | RejectDirectSend; DMARC | Exchange Online; DNS |
Illustrative example, figures are fictional. Day 1, 09:12: an accounts payable clerk at Fernbrook Dental receives a message that asks her to enter a code at a Microsoft sign-in page to open a shared invoice. She enters it. Day 1, 09:14: the attacker holds her tokens and reads her mailbox. Day 1, 09:40: a new rule moves any message containing "wire" to the RSS Subscriptions folder. Day 4: from her real address, the attacker asks a supplier to change a bank account. The supplier calls the number on file and the request stops.
Three controls had a chance. The device code block stops day 1. The hidden rule is the symptom Microsoft lists. The call to a known number stopped the payment, with no tool involved.
Track three numbers each week, each in a report you already have.
No. Token theft kits capture OAuth tokens or session cookies after the user completes sign-in, so the attacker skips the MFA prompt. Phishing-resistant methods such as FIDO2 keys and Windows Hello for Business close more of that gap.
The attacker sends a code and asks the victim to enter it on a real Microsoft page. The victim authorizes the attacker's device, and the attacker captures access and refresh tokens. The fix is a Conditional Access block on device code flow.
It depends on the tenant. The Automatic - System-controlled setting changed in 2021 to Off for new organizations, while existing organizations already using it can still have forwarding On. Set the policy to Off yourself.
Yes. The FBI describes QR lures that lead to pages imitating Microsoft 365 sign-in and end in session token theft. The scan happens on a phone, so the email filter never sees the final page.
Block device code flow in report-only mode, then move it to On when the report is clean. Next, set user consent to verified publishers and external forwarding to Off.
