High-volume Exchange Online REST exfiltration via One Outlook Web client

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects anomalous high-volume access to Exchange Online via the One Outlook Web/Office client, potentially indicating data exfiltration or automated mass email access by a compromised account.