Skip to content

Instantly share code, notes, and snippets.

View zhaol-tech's full-sized avatar

zhaol-tech

View GitHub Profile
@zhaol-tech
zhaol-tech / mailbox-compromise-guide.md
Created April 21, 2026 18:07
Why Outlook mailbox compromise persists after password reset and MFA — and how to remediate

Outlook Mailbox Compromise — Why It Persists After Password Reset & MFA

This is a classic "account compromise that won't die" scenario. Password resets and MFA rotation don't kill every persistence vector. The likely culprits, in order of probability:

1. OAuth / third-party app consent (most common)

A malicious app the victim consented to (or that was granted via a phishing link) has its own access token that's independent of the password. Password changes, MFA resets, and force-logout do not revoke OAuth app tokens on consumer Microsoft accounts. The app can read mail and create/recreate rules via the Graph/EWS API.