Legitimate Apps as Traitorware for Persistent Microsoft 365 Compromise

Huntress details a business email compromise in Microsoft 365 where an attacker used a compromised user account to add legitimate OAuth apps (eM Client, SuperMailer), grant delegated permissions including offline_access and Mail.Send/Mail.Read, and create inbox rules to hide incoming messages—allowing persistent, stealthy access via refresh tokens; the report highlights detection signals in Azure AD logs and recommends tightening consent controls and monitoring app/service-principal activity.