Microsoft 365 BEC: Malicious Inbox Rules

An adversary-in-the-middle phishing kit steals an AP manager's Microsoft 365 session token, bypassing MFA. The actor creates hidden inbox rules to collect mail and suppress replies, then hijacks a live vendor payment thread to redirect a six-figure wire transfer. Work the Entra sign-in audit, Exchange Online rule events, and email evidence to reconstruct the chain.