Malicious Connectors Potentially Impact Hundreds of Millions of Microsoft 365 Users

The report warns that attackers are increasingly abusing Microsoft 365 Outlook rules, forms, and Exchange connectors to maintain persistence, conceal activity, and facilitate payment fraud after account compromise—often via adversary-in-the-middle phishing that steals session cookies despite MFA. It highlights that these server-side connectors are easy to miss, persist across password changes, and are now common enough that Microsoft provides specific guidance; it includes steps to locate and review connectors, recommends enabling phishing-resistant MFA (e.g., FIDO), monitoring for creation/modification of rules/forms/connectors, and watching for anomalies like mismatched 5321.MailFrom and 5322.From in headers.