We explain how attackers keep reading mail after M365 session revocation
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A security research post explains why, after a phished Microsoft 365 user's sessions are revoked or password reset, attackers can keep reading mail through API-based access until existing tokens expire (up to about 90 minutes for access tokens).