ARTSender BEC reply hijacking invoice/payment threads post token theft
Detects outbound email replies concerning invoices or payments sent by a user shortly after performing a device-code authentication flow, indicative of an ARTSender proxy attack where the attacker hijacks an existing email conversation to conduct Business Email Compromise (BEC).
YARA-L
