Our research on Microsoft 365 attacker behavior.

Deep dives on how to detect Microsoft account compromises, from the team at Petra Security.

Malicious Inactivity

A quiet account after a suspicious login is not an all clear.

Ed Torgas · Sep 21, 2026

When Axios is Innocent

Ed Torgas · Sep 1, 2026

When Are Legitimate Apps Actually Malicious?

Ed Torgas · Aug 7, 2026

All Research

Jul 13, 2026Ed Torgas

Stop Attacks Before Damage

Automated toolkits inflict damage within minutes of access. The challenge has shifted from simply catching attacks to stopping them before damage is inflicted.

Jun 18, 2026Ed Torgas

Device Code Phishing, Part 2: What Attackers Do After They Get In

The login looks clean. The damage happens after, on a session Microsoft already trusts.

Apr 30, 2026Adithya Vellal

Device Code Phishing, Part 1: How the Attackers Get In

A new phishing technique is breaking the assumption that a clean session stays clean.

Apr 24, 2026Adithya Vellal

How Residential Proxy Attacks Defeat Location-Based Detection in Microsoft 365

Why logins alone aren't enough to catch these attackers anymore.

Mar 3, 2026Adithya Vellal

When Attackers Modify Your Mail Flow

How attackers misuse inbound connectors for persistence and internal phishing in M365.

Feb 24, 2026Adithya Vellal

How Your Client Got an Email from Themself

Attackers exploit Microsoft 365 Direct Send for credential theft.

Jul 21, 2025Adithya Vellal

New Password Spray Campaign Using Residential Proxies

A stealthy password spray campaign using Virginia-based residential proxies.

Jun 29, 2025Adithya Vellal

Why Travel Allowlists Cause More Pain Than Protection

Jun 16, 2025Adithya Vellal

BECs Don't Always Target Your Emails

SharePoint is often the real target in business email compromises.

Jun 7, 2025Adithya Vellal

Corporate Espionage in the Cloud

How attackers exfiltrate data without leaving detectable traces.

The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.

During this time, the attacker:

Accessed

0 emails

0 documents

Sent

0 emails

0 documents

Modified

0 emails

0 documents

Deleted

0 emails

0 documents

UPN:

askywalker@acmecorp.com

Mail:

askywalker@acmecorp.com

Created:

1/8/2023, 12:31:31 PM

Title:

AP Manager

Dept:

Accounts Payable

Location:

San Francisco, California, United States

No authentication methods found

Activity

Refresh

Export

1/5/26 - 2/8/26

Timeline

Logins

Exchange

SharePoint

Teams

Auth Methods

Devices

Permissions

Apps

URL Clicks

Activity Type

Timestamp

Attacker Action

Attacker Target

IP Address

ISP

City

Region

Country

2026-02-04 11:57:09 AM PST

officehome

185.86.151.95Data Center

latitude.sh

buffalo

united states

2026-02-04 12:31:59 PM PST

officehome

87.120.191.105Data Center

routerhosting llc

buffalo

united states

2026-02-04 12:32:36 PM PST

officehome

45.148.10.88Data Center

datacamp limited

buffalo

united states

2026-02-04 12:32:46 PM PST

officehome

194.5.82.48Data Center

psychz networks

buffalo

united states

2026-02-04 01:52:03 PM PST

office 365 exchange online

91.134.31.72Proxy

latitude.sh

frankfurt am main

germany

2026-02-04 01:53:01 PM PST

officehome

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 01:53:02 PM PST

officehome

87.120.191.105Data Center

routerhosting llc

limburg an der lahn

germany

2026-02-04 01:53:14 PM PST

office 365 exchange online

45.148.10.88Data Center

datacamp limited

limburg an der lahn

germany

2026-02-04 01:53:33 PM PST

Email: Read

ACH Remittance Advice – Payment ID #2389172

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 01:53:34 PM PST

Email: Read

ACH Remittance Advice – Payment ID #2389172

87.120.191.105Data Center

routerhosting llc

limburg an der lahn

germany

2026-02-04 01:53:34 PM PST

Email: Updated

ACH Remittance Advice – Payment ID #2389172

45.148.10.88Data Center

datacamp limited

limburg an der lahn

germany

2026-02-04 01:54:21 PM PST

Email: Hard Deleted

Outlook Rules Organizer

194.5.82.48Data Center

psychz networks

limburg an der lahn

germany

2026-02-04 01:54:31 PM PST

my profile

194.5.82.48Data Center

psychz networks

limburg an der lahn

germany

2026-02-04 01:54:45 PM PST

my signins

91.134.31.72Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:02:40 PM PST

Email: Read

Decentralized user-facing synergy

91.134.31.72Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:02:40 PM PST

Email: Updated

Invoice and PO Confirmation for March Services

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:04:21 PM PST

my signins

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:06:05 PM PST

App: Registered em client

185.86.151.95Data Center

latitude.sh

buffalo

germany

2026-02-04 02:06:06 PM PST

App: Registered em client

185.86.151.95Data Center

latitude.sh

buffalo

germany

2026-02-04 02:11:43 PM PST

Email: Read

RE: Finalized Q1 2025 Statements Attached

87.120.191.105Data Center

routerhosting llc

buffalo

germany

2026-02-04 02:11:44 PM PST

Email: Read

RE: Finalized Q1 2025 Statements Attached

45.148.10.88Data Center

datacamp limited

buffalo

germany

During this time, the attacker:

Accessed

0 emails

0 documents

Sent

0 emails

0 documents

Modified

0 emails

0 documents

Deleted

0 emails

0 documents

UPN:

askywalker@acmecorp.com

Mail:

askywalker@acmecorp.com

Created:

1/8/2023, 12:31:31 PM

Title:

AP Manager

Dept:

Accounts Payable

Location:

San Francisco, California, United States

No authentication methods found

Activity

Refresh

Export

1/5/26 - 2/8/26

Timeline

Logins

Exchange

SharePoint

Teams

Auth Methods

Devices

Permissions

Apps

URL Clicks

Activity Type

Timestamp

Attacker Action

Attacker Target

IP Address

ISP

City

Region

Country

2026-02-04 11:57:09 AM PST

officehome

185.86.151.95Data Center

latitude.sh

buffalo

united states

2026-02-04 12:31:59 PM PST

officehome

87.120.191.105Data Center

routerhosting llc

buffalo

united states

2026-02-04 12:32:36 PM PST

officehome

45.148.10.88Data Center

datacamp limited

buffalo

united states

2026-02-04 12:32:46 PM PST

officehome

194.5.82.48Data Center

psychz networks

buffalo

united states

2026-02-04 01:52:03 PM PST

office 365 exchange online

91.134.31.72Proxy

latitude.sh

frankfurt am main

germany

2026-02-04 01:53:01 PM PST

officehome

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 01:53:02 PM PST

officehome

87.120.191.105Data Center

routerhosting llc

limburg an der lahn

germany

2026-02-04 01:53:14 PM PST

office 365 exchange online

45.148.10.88Data Center

datacamp limited

limburg an der lahn

germany

2026-02-04 01:53:33 PM PST

Email: Read

ACH Remittance Advice – Payment ID #2389172

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 01:53:34 PM PST

Email: Read

ACH Remittance Advice – Payment ID #2389172

87.120.191.105Data Center

routerhosting llc

limburg an der lahn

germany

2026-02-04 01:53:34 PM PST

Email: Updated

ACH Remittance Advice – Payment ID #2389172

45.148.10.88Data Center

datacamp limited

limburg an der lahn

germany

2026-02-04 01:54:21 PM PST

Email: Hard Deleted

Outlook Rules Organizer

194.5.82.48Data Center

psychz networks

limburg an der lahn

germany

2026-02-04 01:54:31 PM PST

my profile

194.5.82.48Data Center

psychz networks

limburg an der lahn

germany

2026-02-04 01:54:45 PM PST

my signins

91.134.31.72Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:02:40 PM PST

Email: Read

Decentralized user-facing synergy

91.134.31.72Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:02:40 PM PST

Email: Updated

Invoice and PO Confirmation for March Services

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:04:21 PM PST

my signins

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:06:05 PM PST

App: Registered em client

185.86.151.95Data Center

latitude.sh

buffalo

germany

2026-02-04 02:06:06 PM PST

App: Registered em client

185.86.151.95Data Center

latitude.sh

buffalo

germany

2026-02-04 02:11:43 PM PST

Email: Read

RE: Finalized Q1 2025 Statements Attached

87.120.191.105Data Center

routerhosting llc

buffalo

germany

2026-02-04 02:11:44 PM PST

Email: Read

RE: Finalized Q1 2025 Statements Attached

45.148.10.88Data Center

datacamp limited

buffalo

germany

During this time, the attacker:

Accessed

0 emails

0 documents

Sent

0 emails

0 documents

Modified

0 emails

0 documents

Deleted

0 emails

0 documents

UPN:

askywalker@acmecorp.com

Mail:

askywalker@acmecorp.com

Created:

1/8/2023, 12:31:31 PM

Title:

AP Manager

Dept:

Accounts Payable

Location:

San Francisco, California, United States

No authentication methods found

Activity

Refresh

Export

1/5/26 - 2/8/26

Timeline

Logins

Exchange

SharePoint

Teams

Auth Methods

Devices

Permissions

Apps

URL Clicks

Activity Type

Timestamp

Attacker Action

Attacker Target

IP Address

ISP

City

Region

Country

2026-02-04 11:57:09 AM PST

officehome

185.86.151.95Data Center

latitude.sh

buffalo

united states

2026-02-04 12:31:59 PM PST

officehome

87.120.191.105Data Center

routerhosting llc

buffalo

united states

2026-02-04 12:32:36 PM PST

officehome

45.148.10.88Data Center

datacamp limited

buffalo

united states

2026-02-04 12:32:46 PM PST

officehome

194.5.82.48Data Center

psychz networks

buffalo

united states

2026-02-04 01:52:03 PM PST

office 365 exchange online

91.134.31.72Proxy

latitude.sh

frankfurt am main

germany

2026-02-04 01:53:01 PM PST

officehome

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 01:53:02 PM PST

officehome

87.120.191.105Data Center

routerhosting llc

limburg an der lahn

germany

2026-02-04 01:53:14 PM PST

office 365 exchange online

45.148.10.88Data Center

datacamp limited

limburg an der lahn

germany

2026-02-04 01:53:33 PM PST

Email: Read

ACH Remittance Advice – Payment ID #2389172

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 01:53:34 PM PST

Email: Read

ACH Remittance Advice – Payment ID #2389172

87.120.191.105Data Center

routerhosting llc

limburg an der lahn

germany

2026-02-04 01:53:34 PM PST

Email: Updated

ACH Remittance Advice – Payment ID #2389172

45.148.10.88Data Center

datacamp limited

limburg an der lahn

germany

2026-02-04 01:54:21 PM PST

Email: Hard Deleted

Outlook Rules Organizer

194.5.82.48Data Center

psychz networks

limburg an der lahn

germany

2026-02-04 01:54:31 PM PST

my profile

194.5.82.48Data Center

psychz networks

limburg an der lahn

germany

2026-02-04 01:54:45 PM PST

my signins

91.134.31.72Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:02:40 PM PST

Email: Read

Decentralized user-facing synergy

91.134.31.72Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:02:40 PM PST

Email: Updated

Invoice and PO Confirmation for March Services

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:04:21 PM PST

my signins

185.86.151.95Data Center

latitude.sh

limburg an der lahn

germany

2026-02-04 02:06:05 PM PST

App: Registered em client

185.86.151.95Data Center

latitude.sh

buffalo

germany

2026-02-04 02:06:06 PM PST

App: Registered em client

185.86.151.95Data Center

latitude.sh

buffalo

germany

2026-02-04 02:11:43 PM PST

Email: Read

RE: Finalized Q1 2025 Statements Attached

87.120.191.105Data Center

routerhosting llc

buffalo

germany

2026-02-04 02:11:44 PM PST

Email: Read

RE: Finalized Q1 2025 Statements Attached

45.148.10.88Data Center

datacamp limited

buffalo

germany

See what's in your last six months of logs.

Get insurance-grade forensics on the last 6 months of your M365 logs. Setup takes 5 minutes with results in 48 hours.

See a demo