I saw a similar method recently where blackhats registered a dodgy app with AzureAD which gave them broad authority. After a few months they inserted themselve

I saw a similar method recently where blackhats registered a dodgy app with AzureAD which gave them broad authority. After a few months they inserted themselves into a conversation about a wire transfer, posing as a finance director. The language was off just enough to raise flags.