{"id":"TECH-202610-phished-microsoft-365-accounts-keep-leaking-mail-for-up-to-9","kind":"technique","aliases":[],"related":[],"title":"Phished Microsoft 365 accounts keep leaking mail for up to 90 minutes after session revocation or password reset, via Graph API, EWS and ActiveSync","description":null,"summary":"Eye Security research (2026-10-29): when a defender revokes Entra sessions or resets the password of a phished M365 user, Continuous Access Evaluation critical-event checks cut off Outlook (classic, web, mobile) and IMAP in real time, but access tokens already issued stay valid for up to 60-90 minutes against Microsoft Graph API, Exchange Web Services and Exchange ActiveSync. Newer automated phishing kits harvest mail through Graph API, so they keep downloading mail after the usual response steps. Only disabling the account blocks mail access in real time; re-enabling it brings back old tokens that have not expired yet. Some Graph endpoints not covered by CAE (e.g. querying Entra users) keep working even while the account is disabled, and there is no way to block that. Every M365 tenant is affected; no fix from Microsoft announced.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft 365","fixed":[]},{"name":"Exchange Online","fixed":[]},{"name":"Microsoft Entra ID","fixed":[]},{"name":"Microsoft Graph API","fixed":[]}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"After an incident response on a phished account, look in the M365 unified audit log / MailItemsAccessed and Entra sign-in logs for Graph API, EWS or ActiveSync mailbox access from the attacker's IP or session in the 90 minutes after you revoked sessions or reset the password. Check your IR playbook: if it only says revoke sessions / reset password, it is exposed.","fix":"For a phished M365 account, disable the account (not just revoke sessions / reset password) and keep it disabled for at least 90 minutes after the last access token was issued, then reset credentials and re-enable. Expect that directory-read Graph calls with the stolen token may still work during that window.","status":"open","published_at":null,"first_seen_at":"2026-10-29T10:25:00+00:00","triaged_at":"2026-10-29T10:25:00+00:00","updated_at":"2026-10-29T10:25:00+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':58B '-202610':26A '-29':59B '-90':104B '2026':57B '365':3A,30A,41A '60':103B '9':39A '90':11A 'access':76B,94B,141B 'account':4A,138B,174B 'accounts':32A 'accounts-keep-leaking-mail-for-up-to':31A 'activesync':24A,115B 'affect':189B 'alreadi':96B 'announc':194B 'api':21A,49A,109B,124B 'autom':117B 'back':150B 'block':139B,183B 'bring':149B 'cae':164B 'check':81B 'classic':85B 'continu':75B 'cover':162B 'critic':79B 'critical-ev':78B 'cut':82B 'defend':62B 'disabl':136B,176B 'download':128B 'e.g':165B 'earli':51B 'early-warn':50B 'enabl':147B 'endpoint':160B 'entra':45A,64B,167B 'evalu':77B 'even':171B 'event':80B 'everi':185B 'ew':22A 'exchang':110B,114B 'exchange':42A 'expir':156B 'eye':54B 'fix':191B 'for':36A 'graph':20A,48A,108B,123B,159B 'harvest':120B 'id':46A 'imap':89B 'issu':97B 'keep':5A,33A,127B,169B 'kit':119B 'leak':6A 'leaking':34A 'm365':73B,186B 'mail':7A,35A,121B,129B,140B 'microsoft':2A,29A,40A,44A,47A,107B,193B 'minut':12A,105B 'mobil':87B 'newer':116B 'old':151B 'online':43A 'outlook':84B 'password':17A,69B 'phish':1A,72B,118B 'phished':28A 'phished-microsoft':27A 'queri':166B 're':146B 're-en':145B 'real':91B,143B 'research':56B 'reset':18A,67B 'respons':133B 'revoc':15A 'revok':63B 'secur':55B 'servic':112B 'session':14A,65B 'stay':98B 'step':134B 'tech':25A 'techniqu':53B 'tenant':187B 'time':92B,144B 'to':38A 'token':95B,152B 'up':37A 'user':74B,168B 'usual':132B 'valid':99B 'via':19A 'warn':52B 'way':181B 'web':86B,111B 'work':170B 'yet':157B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T09:59:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-phished-microsoft-365-accounts-keep-leaking-mail-for-up-to-9","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T10:25:00+00:00","fetched_at":"2026-10-29T10:25:00+00:00","note":null}],"documents":[{"id":15677,"url":"https://news.ycombinator.com/item?id=50286745","title":"We explain how attackers keep reading mail after M365 session revocation","kind":"post","source":"hackernews","publisher":null,"text":"We explain how attackers keep reading mail after M365 session revocation\nhttps://labs.eye.security/how-attackers-keep-reading-mail-after-m365-session-revocation/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-29T10:09:08+00:00","relation":"describes","confidence":null,"note":null},{"id":15800,"url":"https://labs.eye.security/how-attackers-keep-reading-mail-after-m365-session-revocation/","title":"How attackers keep reading mail after M365 session revocation - Eye Research","kind":"blog","source":"analyst","publisher":null,"text":"Eye Security (Martin Warmer): Entra session revocation and password reset trigger CAE critical event evaluation that cuts off Outlook classic/web/mobile and IMAP in real time, but already-issued access tokens keep working for up to 90 minutes against Microsoft Graph API, Exchange Web Services and Exchange ActiveSync. Only disabling the account blocks mail access in real time; re-enabling restores old access tokens still in validity, so keep the account disabled for 90 minutes after the last token issued. Graph endpoints not covered by CAE (e.g. querying Entra users) keep working even after disable. Newer automated phishing kits use Graph API to collect mail, so revoke/reset alone lets them keep downloading mail.","published_at":"2026-10-29T09:59:16+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}