When the Tool is the Weapon Abusing (and defending) native M365 applications

Alexis Watters, an email forensic investigator who handles business email compromise cases mostly for small and mid-sized businesses, opens by arguing that attackers now look well beyond the mailbox. Her caseload has grown quickly, the time from a phishing email to a compromised account has shrunk to minutes, and multi-factor authentication is often bypassed through reverse proxies and phishing kits, so layered defenses matter more than any single control.

The middle of the talk covers abuse of Microsoft 365 applications outside email. Attackers have messaged users in Teams posing as recruiters or help desk staff, then used calls to obtain credentials or MFA codes. Shared SharePoint and OneNote links set to anyone-with-the-link or anonymous access let attackers pull files and spread lures from a compromised tenant. Power BI pages have served as intermediate hops in phishing chains, and compromised global admins have added inbound connectors to push spam that carries Microsoft IP addresses. Attackers have also browsed Teams chats to locate files quickly and used Viva Insights to see whether their lures were opened.

The closing section gives defenders practical steps. Restrict Teams external access to trusted domains, tighten SharePoint sharing and anonymous access, separate admin accounts from daily mailboxes, and confirm the unified audit log is enabled, since it is the main source for investigations. She also stresses a culture where staff report suspicious clicks early rather than being blamed, and expects Copilot and AI summaries to be abused next.