Attackers still target the mailbox because it holds password-reset links, vendor trust, and the contracts that run the business. The path in has shifted entirely from endpoint to identity, which is why mailbox defense now belongs to the identity layer rather than the email gateway.
In August 2025, the threat actor UNC6395 used stolen OAuth tokens from the Salesloft Drift integration to read customer Salesforce instances. Through a separate compromise of the Drift Email integration, the attacker also reached a small number of Google Workspace mailboxes that same week. No malware ran on a victim endpoint, and no phishing lure landed in a user’s inbox. The route to the mailbox was an application grant the customer had already approved.
The mailbox is still the target. The route to reach it now runs through identity, and the detection signal lives in the identity logs.
A compromised mailbox unlocks the identity perimeter.
The mailbox is the recovery channel for the rest of the workforce identity surface. Password-reset codes, MFA enrollment links, magic-link sign-ins, and identity-verification messages all land there. With mailbox access, an attacker can drive password resets across the SaaS estate and stage account takeovers that survive the user’s later password reset.
Standing OAuth grants extend the access past a password change. If an attacker established an application grant during the access window, the grant lives at the application layer rather than the credential layer, and resetting the user’s password does not revoke it. The fix requires revoking the consent in the identity provider and deleting the service principal.
From a compromised mailbox, attackers also exfiltrate the organization’s trust relationships. The CSRB review of Storm-0558 quantified the leverage at roughly 60,000 State Department emails plus a full directory of employee addresses across 22 organizations and more than 500 individuals. The directory is the foundation of the next phishing campaign.
Financial workflows are the monetization end-state. Invoices, payment-change requests, and vendor onboarding emails traverse mail threads, which is how attackers turn mailbox access into business email compromise. The IC3 2025 report attributed $3 billion to BEC across 24,768 incidents, the second-largest loss category for reported cybercrime that year.
Attackers now reach mailboxes through the identity layer.
Four routes account for most mailbox compromises across recent investigations, and all four converge on identity rather than the endpoint. In real intrusions, attackers chain two or three of them rather than picking one. Each one bypasses the email security gateway entirely, which is why the layer that catches them is identity.
Adversary-in-the-middle phishing. A user clicks a link, lands on what looks like a Microsoft sign-in page, enters credentials, completes MFA, and proceeds to a real Microsoft document. The page in front of the user was a reverse proxy, and the kit captured the session cookie on its way through. Replay of that cookie (T1557) gives the attacker the same mailbox access the user had, with no second prompt. Tycoon 2FA, EvilProxy, and Sneaky 2FA are among the most active kits. Microsoft’s Digital Defense Report 2025 attributes most successful MFA bypasses to session-token theft of this kind.
OAuth consent phishing. Attackers register a malicious application and obtain user or admin consent to it. The consent persists at the application layer, so resetting the password or enrolling MFA does not revoke the access (T1528). Microsoft’s consent phishing guidance describes the kit-driven version. Attackers can exploit the same trust pattern to escalate consent inside an organization, as Midnight Blizzard demonstrated by chaining a legacy test OAuth application, a created user account, and the Exchange Online full_access_as_app role to grant mailbox access across Microsoft’s own corporate tenant.
Infostealer-derived credentials. Stolen credentials rose to the second-most-common initial infection vector at 16% of investigated intrusions in M-Trends 2025, most of them captured by infostealer malware on personal or unmanaged devices. The mailbox is the natural first stop once those credentials are replayed against the tenant (T1078.004).
Provider-key compromise. An attacker forges authentication tokens directly by stealing the identity provider’s signing key. Storm-0558 used a stolen Microsoft signing key to issue tokens that worked across the boundaries of 22 organizations and more than 500 individuals, including the U.S. State Department, the Department of Commerce, and the office of the U.S. ambassador to China. Token forgery (T1606) is not Microsoft-specific, and any identity provider whose signing keys an attacker compromises produces the same outcome. Customers had no way to detect the activity until anomalous MailItemsAccessed events surfaced in the Purview audit log, which is the detection CISA and the FBI recommend enabling.
Inside the mailbox, attackers read, hide, and persist.
Once inside, attackers spend most of their time reading the mailbox and shaping it to hide their tracks. That work is observable when the right logs are on, and stealthy when they aren’t.
Bulk reading. The first thing attackers usually do is open and search the mailbox (T1114.002). The signal in Microsoft 365 is the MailItemsAccessed event, which fires when a user or any process using the user’s authentication reads a message. Counts in the thousands per user per day deserve hard scrutiny. Batching and throttling under heavy access make any specific threshold a starting point rather than a hard rule.
Inbox-rule creation. Attackers create rules to hide their activity from the user (T1564.008). A typical rule forwards messages containing “invoice,” “payment,” or “wire” to an external address, moves security alerts into the RSS Subscriptions folder, or deletes replies that would otherwise raise the user’s suspicions. Proofpoint’s Q4 2025 finding recorded malicious rules on roughly 10% of breached accounts, created within seconds of initial access. Microsoft’s forwarding-rule playbook for Defender XDR is the first place to look.
Hidden rules. Some attackers create rules through MAPI that don’t appear in Outlook’s UI or the Exchange admin center. Microsoft’s compromised-mailbox playbook recommends running Get-InboxRule -Mailbox <Identity> -IncludeHidden during an investigation, which queries the underlying storage directly and surfaces rules standard tooling won’t show.
Persistent OAuth grants. When the access route is a consented application rather than a password, password reset and MFA enrollment don’t revoke it (T1098.003). The fix is to revoke the consent in Entra ID’s enterprise apps view and to delete the service principal. Periodic review of granted scopes is what keeps the defense durable.
Exfiltration via Graph API. The attacker exfiltrates data through the same authenticated channel they used to read it (T1567). Blocking legacy mail protocols such as IMAP and POP still has value, but it doesn’t close this path, because the Microsoft Graph API is what modern attackers script against.
Defenses that work belong to the identity layer.
Each effective control here is about identity, observability, or scope reduction. The mailbox is the asset, but the work is at the identity layer.
Phishing-resistant MFA. Hardware security keys, passkeys, and certificate-based authentication are the only authenticators that AiTM kits cannot relay. App-prompt MFA, push-approval MFA, and one-time codes all flow through the same proxy as the user. M-Trends 2025 specifically recommends AiTM-resistant MFA. The practical phasing is to move administrative accounts first, then workforce accounts, because the full rollout is multi-quarter work.
OAuth app governance. Administrators can require admin approval for any application requesting more than basic scopes. Microsoft’s illicit consent grants playbook covers detection through Get-AzureADPSPermissions.ps1 and remediation by revoking app permissions in Entra. Periodic review of granted scopes is the underrated half of the work, because applications that received consent six months ago are still there. Employees connect legitimate tools on purpose, and those grants need the same review as the malicious ones attackers register. AI assistants, mail-search add-ons, and backup services pull mail into a vendor’s store, and a vendor holding thousands of mailboxes is a target in its own right, the way the Salesloft Drift integration was. Vet each one before the grant, asking what it does with the mail, whether it keeps a copy or reads it live, and what access survives after someone stops using it.
Mailbox audit logging. MailItemsAccessed and the Unified Audit Log are the difference between detecting a mailbox compromise within days and finding out from a third party. Microsoft made these logs available across all licenses in 2023 after CISA called out the licensing gap in the Storm-0558 response. There is no longer a cost excuse for leaving them off.
Data minimization. What isn’t in the mailbox can’t be stolen from it. Pushing sensitive material into systems with audit trails and tighter access boundaries is a control that doesn’t show up in security-tool reviews, and it’s one of the few that actually reduces what an attacker takes home from a successful compromise. Retention policies on the mailbox itself are the other half. Email that hasn’t been touched in years shouldn’t still be in the inbox.
Password resets, contracts, vendor relationships, and authentication artifacts all converge in the mailbox. That’s why attackers target the mailbox, and defending it is identity work. Teams that treat the mailbox as an identity asset detect compromises in days, while teams that treat it as a message store read about their compromises in the news.
The first move worth making is to pull the list of OAuth applications with mailbox-access scopes in your tenant and ask about the ones you don’t recognize. The logs you turn on while doing that are the same ones you’ll cite in the incident report afterwards.
