Live › technique › TECH-202610-phished-microsoft-365-accounts-keep-leaking-mail-for-up-to-9
Eye Security research (2026-10-29): when a defender revokes Entra sessions or resets the password of a phished M365 user, Continuous Access Evaluation critical-event checks cut off Outlook (classic, web, mobile) and IMAP in real time, but access tokens already issued stay valid for up to 60-90 minutes against Microsoft Graph API, Exchange Web Services and Exchange ActiveSync. Newer automated phishing kits harvest mail through Graph API, so they keep downloading mail after the usual response steps. Only disabling the account blocks mail access in real time; re-enabling it brings back old tokens that have not expired yet. Some Graph endpoints not covered by CAE (e.g. querying Entra users) keep working even while the account is disabled, and there is no way to block that. Every M365 tenant is affected; no fix from Microsoft announced.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 10:25 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft 365 | – | – | – |
| Exchange Online | – | – | – |
| Microsoft Entra ID | – | – | – |
| Microsoft Graph API | – | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("TECH-202610-phished-microsoft-365-accounts-keep-leaking-mail-for-up-to-9")