Research

Our research on Microsoft 365 attacker behavior.

Deep dives on how to detect Microsoft account compromises, from the team at Petra Security.

Latest research

Threat Research Apr 30, 2026

Device Code Phishing, Part 1: How the Attackers Get In

A new phishing technique is breaking the assumption that a clean session stays clean. Three real device code phishing cases, from a Railway workload to a Nord VPN exit node landing on the user's own registered device.

Read the research

Threat Research Apr 24, 2026

How Residential Proxy Attacks Defeat Location-Based Detection in Microsoft 365

Why logins alone aren't enough to catch these attackers anymore.

Threat Research Mar 3, 2026

When Attackers Modify Your Mail Flow

How attackers abuse inbound connectors for persistence and internal phishing in M365.

All research

Sorted by most recent

Threat Research

Device Code Phishing, Part 1: How the Attackers Get In

A new phishing technique is breaking the assumption that a clean session stays clean.

Threat Research

How Residential Proxy Attacks Defeat Location-Based Detection in Microsoft 365

Why logins alone aren't enough to catch these attackers anymore

Threat Research

When Attackers Modify Your Mail Flow

How attackers abuse inbound connectors for persistence and internal phishing in M365

February 24, 2026

Threat Research

How Your Client Got an Email from Themself

How attackers abuse Microsoft 365 Direct Send to deliver phishing emails and steal credentials

Threat Research

New Password Spray Campaign Using Residential Proxies

A stealthy password spray campaign is using Virginia-based residential proxies. Here’s what we’re seeing and how to block it.

Threat Research

Why Travel Allowlists Cause More Pain Than Protection

“Only allow log‑ins from known places” sounds great, but falls apart in practice.

Threat Research

BECs Don't Always Target Your Emails

SharePoint is often the real target in business “email” compromises

Threat Research

Corporate Espionage in the Cloud

The quiet side of BEC: how attackers exfiltrate data without leaving a trace

Threat Research

When A Tesla Looks Like an Attacker

A case study in why anomaly detection isn't enough

Threat Research

How Attackers Launder Phishing Emails Through Microsoft Infrastructure

Attackers often use hacked accounts to "OneDrive Phish" other companies. This allows them to launder their phishing emails through Microsoft infrastructure. So, how can we detect and stop them?

Threat Research

How "Many Failed Login" Alerts Can Bury the Signal That Matters

A case study in how alerting on noise can cause you to miss the real attack

Threat Research

New Data Center Observed in Widespread AitM Attack Campaign

A data center in Tampa is the backbone of a new wave of AitM phishing campaigns we've observed. Here's what you need to know and how to block it.

Threat Research

Compromised, then Weaponized: Anatomy of a OneDrive Phishing Campaign

A data center in Tampa is the backbone of a new wave of AitM phishing campaigns we've observed. Here's what you need to know and how to block it.

Threat Research

That Android 6 Login? It Was Actually Windows 10.

Why anomalous user agent strings can be misleading

Threat Research

Why Does Teams Activity Appear in SharePoint Logs? And Why Does This Matter to Attackers?

Attachments in Teams chats use OneDrive under the hood, so they actually appear in SharePoint logs. Plus: why this matters for attackers disguising their actions.

Threat Research

Unmasking A Slow and Steady Password Spray Attack

Catching an attacker hiding in plain sight with some creative log slicing

Threat Research

What's up with all that Impossible Travel in SharePoint?

Differentiating between real IPs and Microsoft datacenters in SharePoint logs. Hugely important for incident investigations.

Threat Research

An Easy Conditional Access Policy to Block Lots of AitM Attacks

We see a lot of attacker-in-the-middle attacks here at Petra. Here's a policy you can use that will block a whole lot of them in your tenant in 5 minutes.

Threat Research

Multi-Stream Tracking an AitM Attack: From Lure to Lockout

Catching an attacker red-handed across event streams—from a OneDrive phishing lure to an automated AitM toolkit in action.

Threat Research

Microsoft Logs Missing for Hours After Attack

Detecting a compromise minutes after it happened without a complete record of how the attacker got in

February 24, 2025

Threat Research

Microsoft Misses Impossible Travel in Email Activity

How an attacker accessed a US account from Turkey without triggering Microsoft alerts

February 18, 2025

Threat Research

How Did Singapore Bypass Your US-Only Conditional Access?

When Microsoft's faulty geolocation makes your security controls fail silently

December 20, 2024

Threat Research

Spelunking in the Microsoft API, Part II: The Truth About Risky Sign-in Alerts

How accurate are Microsoft's native security signals? (Not very.)

December 9, 2024

Threat Research

Spelunking in the Microsoft API, Part I: Entra ID Latency

One of the most important and least understood factors for building ML systems using Entra ID Login Events

November 23, 2024

Threat Research

Anatomy of a Sophisticated Multi-Infrastructure Password Spray Campaign

One of the most important and least understood factors for building ML systems using Entra ID Login Events