Consent Granted: Malicious OAuth App Mailbox BEC

A consent-phishing intrusion where an adversary-in-the-middle proxy steals a finance analyst's Microsoft 365 session, then the attacker tricks her into granting a malicious multitenant OAuth application delegated mailbox permissions. The app gets its own client secret for durable access, reads her mailbox over Microsoft Graph, hides vendor replies with an inbox rule, and sends a fraudulent bank-detail-change reply into a live settlement thread. Work the Entra consent and permission-grant audit, the service-principal credential change, the Graph mailbox operations, and the email evidence to reconstruct the chain.