As an update, the attackers were discovered by the customer due to mailbox access event logs showing an unexpected mail client to access mailbox items.[1][2] Th

As an update, the attackers were discovered by the customer due to mailbox access event logs showing an unexpected mail client to access mailbox items.[1][2] The attacker should have spoofed a realistic mail client. [1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... [2] https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc https://learn.microsoft.com/en-us/office365/servicedescripti...