My outlook account notices some unusual IMAP Login from Microsoft at Redmond

some reddit threads about this:

https://www.reddit.com/r/Outlook/comments/vy2gej/unusual_sign_in_activity_reported_for_my/?sort=new https://www.reddit.com/r/Outlook/comments/vz04yd/i_am_not_sure_if_i_got_hacked_some_microsoft_ip/?sort=new

You're right, people are already becoming desensitized to the logins and assuming it is just microsoft doing maintenance in a nonsensical way. And the account activity page stops flagging logins as unusual after it gets flooded with so many.

This is much worse than the phishing campaign, it doesn't seem to require any user interaction except to open an email client once. It doesn't care about app-passwords or 2fa. Changing passwords barely slows it down because a user is likely to keep using their email client after. Having a strong password clearly doesn't matter because the attackers are syncing on the first attempt regardless. I can't think of anything that might mitigate how bad this is.

Overall, attacks on our email accounts appears to be part of a larger scheme of attacks.

Microsoft has been reporting to the media MFA skipping attacks on email systems at over 10000 companies so far -

https://arstechnica.com/information-technology/2022/07/microsoft-details-phishing-campaign-that-can-hijack-mfa-protected-accounts/ https://www.zdnet.com/article/microsoft-warning-this-phishing-attack-can-skip-your-defenses-and-has-hit-10000-firms-already/

"In the days following the theft of an authenticated session cookie, attackers were observed scanning Outlook online inboxes every few hours for email chains to exploit for payment fraud. They also set inbox rules to hide replies from the fraud target from the victim.

Attackers also deployed tactics to hide their access, such as deleting the original phishing email from the victim’s inbox. This was a manual operation and differed from the initial attack which was automated."

Replay attacks exploiting some loophole in Microsoft's email servers appear to be part of the story. However, the point of these repeated attacks may also be to desensitize Microsoft's unusual activity sensing systems. If your email account is being constantly accessed by 13.101.x.x, then over time, it is no longer an unusual activity. The intruders can then access your emails, and you wouldn't even know, because they'll get to your emails before you do, and they'll approve financial transactions on your behalf, and you wouldn't even know. Using Azure cloud services is part of this story so that Microsoft won't suspect it's own IP addresses. Some of these Azure services may be used on behalf of some of us too, because we'll never know that they are being used.

Hello everyone.

I've had a similar problem.

Successful sync attempts too.

Here is a miscorosft forum post i've made about it:

https://answers.microsoft.com/en-us/outlook_com/forum/all/suspicious-activity-allegedly-coming-from-a/82c1495a-a1b2-4dc1-998d-57e898210b4d