---
id: "TECH-202610-phished-microsoft-365-accounts-keep-leaking-mail-for-up-to-9"
kind: "technique"
aliases: []
title: "Phished Microsoft 365 accounts keep leaking mail for up to 90 minutes after session revocation or password reset, via Graph API, EWS and ActiveSync"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Microsoft 365", "fixed": []}, {"name": "Exchange Online", "fixed": []}, {"name": "Microsoft Entra ID", "fixed": []}, {"name": "Microsoft Graph API", "fixed": []}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-29T10:25:00+00:00"
updated_at: "2026-10-29T10:25:00+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T10:25:00+00:00"}]
---

# Phished Microsoft 365 accounts keep leaking mail for up to 90 minutes after session revocation or password reset, via Graph API, EWS and ActiveSync

Eye Security research (2026-10-29): when a defender revokes Entra sessions or resets the password of a phished M365 user, Continuous Access Evaluation critical-event checks cut off Outlook (classic, web, mobile) and IMAP in real time, but access tokens already issued stay valid for up to 60-90 minutes against Microsoft Graph API, Exchange Web Services and Exchange ActiveSync. Newer automated phishing kits harvest mail through Graph API, so they keep downloading mail after the usual response steps. Only disabling the account blocks mail access in real time; re-enabling it brings back old tokens that have not expired yet. Some Graph endpoints not covered by CAE (e.g. querying Entra users) keep working even while the account is disabled, and there is no way to block that. Every M365 tenant is affected; no fix from Microsoft announced.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Microsoft 365 affected ? fixed ?
- :Exchange Online affected ? fixed ?
- :Microsoft Entra ID affected ? fixed ?
- :Microsoft Graph API affected ? fixed ?

## How to check

After an incident response on a phished account, look in the M365 unified audit log / MailItemsAccessed and Entra sign-in logs for Graph API, EWS or ActiveSync mailbox access from the attacker's IP or session in the 90 minutes after you revoked sessions or reset the password. Check your IR playbook: if it only says revoke sessions / reset password, it is exposed.

## Fix

For a phished M365 account, disable the account (not just revoke sessions / reset password) and keep it disabled for at least 90 minutes after the last access token was issued, then reset credentials and re-enable. Expect that directory-read Graph calls with the stolen token may still work during that window.

## Timeline

- 2026-10-29T10:25:00+00:00 analyst

## Documents

- [describes] We explain how attackers keep reading mail after M365 session revocation https://news.ycombinator.com/item?id=50286745
- [describes] How attackers keep reading mail after M365 session revocation - Eye Research https://labs.eye.security/how-attackers-keep-reading-mail-after-m365-session-revocation/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_