#ShadyHacks with Kyle Hanslovan

What it is

A recap of Huntress's "Live Hacking into Microsoft 365" webinar, in which CEO Kyle Hanslovan demonstrates a live identity-based M365 account takeover. The value beyond the summary is the specific detection detail on post-compromise inbox rules and the framing of why this attack path works — no exploits, malware, or zero-days are used at any stage.

Detection: malicious inbox rules

The summary notes "inconspicuously named" rules; the page gives the actual indicators to hunt for:

• Rule names that are deliberately trivial — a single period (.) is called out as a common example.
• Forwarding rules keyed on sensitive terms: invoice, password reset, confidential, wire transfer, auto-forwarded to an attacker-controlled address.
• Move-to-folder rules that stash matching mail in rarely viewed folders like RSS Feeds or Junk, so the victim never sees it and the attacker collects it later.

Auditing M365 mailboxes for oddly/blank-named rules, external-forwarding rules, and rules that relocate mail to RSS Feeds/Junk is the concrete hunt this page supports.

Why it matters (the threat model)

The page states Huntress's telemetry shows 3× the number of "high" and "critical" incidents for identities versus endpoints — the argument for treating identity, not the endpoint, as the primary battleground. It also notes attackers prize freshly stolen credentials because security products increasingly detect and invalidate previously-compromised passwords, so credential age is a signal both attackers and defenders care about.

The chain, and where it can be cut

flowchart TD
    A[Buy fresh creds<br/>Russian Market] --> B[Login attempt]
    B --> C{MFA prompt}
    C -->|blocks password-only| D[Phish for session token]
    D --> E[Fake CAPTCHA / ClickFix<br/>PowerShell via Run dialog]
    E --> F[Infostealer exfil cookies]
    F --> G[Cookie Editor import<br/>MFA bypassed]
    G --> H[Inbox rules + lateral movement]

The turning point is step E: MFA is not defeated cryptographically — the user is tricked into pasting an attacker's PowerShell command into the Run dialog (Win+R, Ctrl+V, Enter) under the guise of "verifying you're human." User awareness of the ClickFix pattern, and blocking clipboard-to-Run execution, breaks the chain before token theft.

Caveats

This is a vendor webinar recap and demo using fictitious credentials ("Grady A."); it names techniques (ClickFix, token impersonation, Cookie Editor) but provides no CVEs, patches, or tooling commands. The full lateral-movement section is truncated in the fetched text.