Microsoft 365 Phishing Vectors: QR, OAuth & Credential Theft

Phishing remains the preeminent initial access vector against Microsoft 365 environments. However, the tactics employed by modern threat actors have evolved far beyond rudimentary credential-harvesting clones. As enterprises enforce Multi-Factor Authentication (MFA), Conditional Access policies, and endpoint telemetry, threat actors have adapted their vectors to evade perimeter inspection and bypass endpoint defenses.

Modern Microsoft 365 phishing campaigns exploit two primary attack paradigms:

1. Device Boundary Hops (Quishing): Using QR codes to transition the victim from a managed, monitored corporate workstation to an unmonitored personal mobile device.
2. Living-off-the-Cloud (LotC): Hosting lures, redirectors, and forms within legitimate Microsoft infrastructure (forms.office.com, sway.office.com, Azure Static Web Apps) to inherit pristine domain reputation and bypass Secure Email Gateways (SEGs).

This guide dissects the technical mechanics of modern M365 phishing techniques, analyzes the telemetry emitted across Defender for Office 365 (MDO) and Exchange Online Protection (EOP), and provides production-grade KQL hunting queries.

---

1. Modern Phishing Taxonomy in Microsoft 365

graph TD
    INBOUND[Inbound Phishing Message] --> VEC{Attack Architecture}

    VEC -->|Image-Based Payload| QUISH[Quishing / QR Code Attack<br/>Embedded PNG/SVG/PDF Lure]
    VEC -->|Cloud Infrastructure Abuse| LOTC[Living-off-the-Cloud Lures<br/>Microsoft Forms, Sway, Azure Blob, SharePoint]
    VEC -->|Real-Time Proxy| AITM[Adversary-in-the-Middle Link<br/>Reverse proxy capturing ESTSAUTH cookie]
    VEC -->|Application Grant| OAUTH[OAuth Consent Request<br/>Permissions: Mail.ReadWrite, offline_access]

    QUISH --> MOB_HOP[Device Boundary Hop:<br/>Victim scans QR with personal mobile phone<br/>Bypasses EDR and Managed Device CA]
    LOTC --> SEG_BYPASS[Reputation Hijacking:<br/>Clean domain scores on *.office.com and *.azurewebsites.net]
    AITM --> SESS_HIJACK[Session Cookie Extraction:<br/>Bypasses MFA Push & Number Matching]
    OAUTH --> TOKEN_ACQ[Persistent Graph API Token:<br/>Permanent access without password dependency]

---

2. Quishing (QR Code Phishing) Deep Dive

2.1 The Architectural Device Boundary Hop

The primary strategic objective of a QR code phishing attack (Quishing) is not merely to bypass optical character recognition (OCR) in email filters; it is to force an architectural boundary hop:

sequenceDiagram
    autonumber
    participant Workstation as Managed Workstation (Corp Network / EDR)
    participant EOP as Exchange Online Protection (EOP / MDO)
    participant Attacker as Adversary Infrastructure (AiTM / Phish Kit)
    participant Mobile as Personal Mobile Device (Unmanaged)

    Attacker->>EOP: Inbound Email with Embedded QR Image
    Note over EOP: Filter evaluates headers & OCR<br/>Image payload parsed as static graphics
    EOP->>Workstation: Message delivered to Outlook Inbox
    Note over Workstation: EDR & Corporate Browser Extensions active.<br/>Conditional Access enforces "Require Compliant Device"
    Workstation-->>Mobile: Victim uses smartphone camera to scan QR code
    Note over Mobile: Personal iPhone/Android (No EDR, No Corp Proxy, Cellular IP)
    Mobile->>Attacker: HTTP GET to Phishing / Reverse Proxy Landing Page
    Attacker->>Mobile: Presents fake Microsoft login + MFA prompt
    Mobile->>Attacker: Victim submits credentials + MFA approval
    Attacker->>Workstation: Attacker replays session tokens against cloud resources

Why the Boundary Hop Succeeds:

• EDR & Web Content Filter Blindness: The corporate endpoint inspection stack never sees the malicious HTTP traffic; the network connection originates from the employee’s personal cellular carrier IP.
• Conditional Access Subversion: While Conditional Access may require compliant devices for critical corporate web apps, legacy or non-migrated endpoints, web portals, or unmanaged registration flows (e.g., aka.ms/mfasetup) frequently allow unmanaged mobile browser connections.

2.2 OCR Evocation & Obfuscation Techniques

Adversaries employ advanced graphical and code techniques to prevent EOP/Defender OCR engines from extracting and analyzing the embedded URL:

1. Embedded SVG Vectors: Rather than attaching a static raster image (PNG/JPEG), the QR code is generated dynamically as Scalable Vector Graphics (<svg><path d="..."/></svg>) or nested <div> blocks styled with CSS background colors.
2. Dynamic Background Contouring & Noise: Injecting random alpha noise, semi-transparent overlays, or gradient color palettes behind the QR finder patterns that human cameras resolve effortlessly, but machine OCR parsers fail to binarize.
3. Multi-Layer PDF Artifacts: Placing the QR code inside a password-protected or multi-page PDF document where the first page contains decoy corporate branding and the second page contains the QR payload.

---

3. Living-off-the-Cloud (LotC) Infrastructure Abuse

To defeat reputation-based filtering in Secure Email Gateways (SEGs) and Defender for Office 365, threat actors construct their phishing lures directly on trusted Microsoft cloud subdomains:

Abused Platform	Hostname Pattern	Threat Actor Technique	Forensic Indicator
Microsoft Forms	forms.office.com/r/...	Creating public surveys designed to emulate Microsoft 365 credential prompts or MFA update requests.	Forms flagged as external; audit logs record FormsData submissions.
Microsoft Sway	sway.office.com/...	Hosting rich, interactive presentation pages with embedded “Review Document” or “Approve Invoice” buttons redirecting to an AiTM proxy.	Sway presentation contains outbound hyperlinks to external proxy domains.
Azure Static Web Apps	*.azurestaticapps.net	Deploying static phishing kits utilizing free Azure tiers; inherits Microsoft TLS certificates.	Inbound links resolve to Azure-hosted CDN endpoints with no corporate association.
SharePoint / OneDrive Sharing	*-my.sharepoint.com/:b:/...	Compromised legitimate accounts used to create anonymous view-only sharing links for malicious PDF lures.	Sender domain matches trusted partner tenant; URL belongs to bona fide SharePoint infrastructure.

Reputation Inheritance

Because security scanners white-label *.office.com and *.sharepoint.com to prevent breaking corporate collaboration, emails containing these URLs frequently receive a Spam Confidence Level of SCL = 1 (Clean) and bypass safe-link rewriting unless URL detonation policies are explicitly configured to inspect native cloud links.

---

4. Defender for Office 365 Telemetry Architecture

When investigating email-borne phishing campaigns, the investigator must correlate three specialized telemetry tables within Microsoft Defender XDR (CloudAppEvents / Advanced Hunting):

graph TD
    MSG[Inbound Email Delivered] --> T_EE[EmailEvents Table<br/>NetworkMessageId, Sender, Recipient, DeliveryAction, ThreatTypes]
    MSG --> T_EUI[EmailUrlInfo Table<br/>Extracted URLs, Domains, URL Categories]
    MSG --> T_EAI[EmailAttachmentInfo Table<br/>FileNames, FileTypes, SHA256 Hashes]

    USER_ACT[User Interacts with Email] --> T_UCE[UrlClickEvents Table<br/>ClickType, ActionType, UserIP, IsClickedThrough]
    T_EE --- T_EUI
    T_EE --- T_EAI
    T_EUI --- T_UCE

4.1 Key Investigative Telemetry Schema

EmailEvents

• NetworkMessageId: The immutable transport correlation ID across all Defender and Exchange logs.
• DeliveryAction: Delivered, Junk, Blocked, Quarantined.
• ThreatTypes: Phish, Malware, Spam.
• DetectionMethods: Machine learning model, Anti-phishing policy, Safe Attachments.

EmailUrlInfo

• Url: The full URI string parsed from the message body or attachments.
• UrlDomain: The fully qualified domain name (FQDN).

UrlClickEvents

• Workload: Email, Teams, OfficeApp.
• ActionType: UrlAllowed, UrlBlocked, UrlError.
• IsClickedThrough: Boolean indicating whether the user bypassed a Defender Safe Links warning page to reach the malicious destination.

---

5. Production KQL Hunting Queries

5.1 Hunting Quishing Campaigns (Image/PDF Attachments with QR Keywords)

Identify incoming messages with image or PDF attachments matching common Quishing social engineering lures:

let PhishKeywords = dynamic(["mfa", "authenticator", "qr", "scan", "salary", "payroll", "docusign", "adobesign", "benefits"]);
EmailEvents
| where TimeGenerated >= ago(7d)
| where DeliveryAction in ("Delivered", "DeliveredToJunk")
| join kind=inner (
    EmailAttachmentInfo
    | where FileType in ("png", "jpg", "jpeg", "svg", "pdf")
) on NetworkMessageId
| extend SubjectLower = tolower(Subject)
| where SubjectLower has_any (PhishKeywords)
| project TimeGenerated, NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject, FileName, FileType, SHA256
| sort by TimeGenerated desc

5.2 Detecting Clicks on Abused Microsoft Cloud Lures (Forms, Sway, Azure)

Identify users who clicked on cloud-hosted phishing links and were not blocked by Safe Links:

UrlClickEvents
| where TimeGenerated >= ago(14d)
| where Workload == "Email"
| where ActionType == "UrlAllowed"
| where Url has_any ("forms.office.com", "sway.office.com", "azurestaticapps.net", "blob.core.windows.net")
| project TimeGenerated, AccountUpn, IPAddress, Url, NetworkMessageId, IsClickedThrough
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated >= ago(14d)
    | where ResultType == 0
    | project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName
) on $left.AccountUpn == $right.UserPrincipalName, $left.IPAddress == $right.IPAddress
| sort by TimeGenerated desc

5.3 Hunting Phishing Emails Evading EOP via Zero-Hour Auto Purge (ZAP)

Identify messages that were delivered to mailboxes but subsequently retroactively removed by Defender ZAP:

EmailPostDeliveryEvents
| where TimeGenerated >= ago(14d)
| where ActionType in ("PhishZAP", "MalwareZAP")
| project TimeGenerated, NetworkMessageId, RecipientEmailAddress, ActionType, ActionTrigger, ActionResult
| join kind=inner (
    EmailEvents
    | project NetworkMessageId, Subject, SenderFromAddress, InternetMessageId
) on NetworkMessageId
| sort by TimeGenerated desc

---

6. Incident Response & Evidentiary Verification Checklist

When an analyst receives an alert regarding an employee who engaged with a phishing lure:

1. Verify Transport Disposition:
   • Query EmailEvents using NetworkMessageId to establish if the email was delivered to the inbox, junk folder, or quarantined.
2. Analyze URL Click Telemetry:
   • Check UrlClickEvents to see if the user clicked the link, and whether Defender Safe Links blocked or permitted the access.
3. Correlate with Authentication Events:
   • Pivot from the user’s UPN to SigninLogs within $\pm 15$ minutes of the click timestamp. Search for unfamiliar IP addresses, unexpected User-Agents, or Entra ID Protection risk events (Unfamiliar sign-in properties, Atypical travel).
4. Inspect Mailbox Activity for Automated Persistence:
   • Check Search-UnifiedAuditLog for operations executed immediately post-click: New-InboxRule, Set-InboxRule, Add-MailboxPermission.

---

7. Cross-Reference & Investigation Navigation

• Previous Fiche: 19. Microsoft 365 Account Compromise Kill Chain
• Next Fiche: 21. Adversary-in-the-Middle (AiTM) Reverse Proxy Mechanics
• Related Guides:
  • 09. Entra ID Sign-in Logs Analysis
  • 12. Entra ID Protection & Risk Detection Forensics
  • 15. Exchange Online Message Trace Forensics
  • 22. Forensic Detection & Investigation of AiTM Attacks
  • 23. OAuth Illicit Consent Grant & Application Phishing
  • 29. Malicious Inbox Rules & Forwarding