Automated Mailbox Scanning for BEC Financial Keywords via Compromised Token

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects automated mailbox access operations such as 'MailItemsAccessed' or 'Search-Mailbox' that are filtered by specific, high-risk financial or Business Email Compromise (BEC) keywords in the email subject line. This behavior is indicative of an automated 'inbox-monitor' style attack, where a compromised OAuth token is used to systematically scrape mailboxes for sensitive financial data.