Business Email Compromise via Azure Administrative Privileges

Huntress discovered and stopped a large-scale Business Email Compromise in which an Azure AD global administrator account was compromised (login from Lagos, Nigeria). The attacker created secondary admin accounts, assigned licenses, and deployed mailbox rules across many user accounts to quietly view and forward emails, repeatedly regaining access until defenders reset credentials, enforced MFA, and disabled the compromised accounts.