Bypassing Two-Factor Authentication on OWA & Office365 Portals

Black Hills Information Security published a technical advisory and PoC showing that Exchange Web Services (EWS) can be used to bypass Outlook Web Access and Office365 multi-factor authentication protections: using the MailSniper tool and valid credentials, an attacker can query the EWS endpoint (Exchange.asmx) to read/search a victim’s mailbox even when OWA is protected by DUO or Azure MFA; the post includes test results, screenshots, mitigation suggestions (restrict EWS, require VPN, or lock down EWS per-user), and a disclosure timeline with Microsoft.