Non-interactive M365 sign-in with Outlook ClientApp masquerading as non-Edge bro

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•3

Detects non-interactive sign-in events to M365 that claim to be from the Outlook client application but utilize suspicious or unexpected User-Agent strings (e.g., Python requests, specific Firefox versions). This behavior is often indicative of programmatic access or automated tools used by attackers to harvest credentials or interact with mailboxes, bypassing standard browser-based authentication controls.