AiTM attacks and business email compromise attacks: what to watch for

This report explains how adversary‑in‑the‑middle (AiTM) credential harvesters are used to bypass MFA and conditional access—commonly enabling business email compromise—by relaying credentials and MFA tokens to authenticate, then using session tokens, registering persistent MFA devices, deleting phishing emails, performing mailbox reconnaissance, and creating inbox rules to hide activity; it also provides specific detections (e.g., consecutive logins from different IPs within ~30 seconds, User registered security info, MoveToDeletedItems/SoftDelete/HardDelete, MailItemsAccessed/AttachmentCollection events, and New/Set‑InboxRule alerts) to help defenders identify and remediate these attacks.