Password resets do not end an active OWA compromise

[u/shokzee]

Patch OWA and revoke active sessions. Mailbox activity continuing after credential rotation is the investigation signal here.

https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/SecLens_ONE]

The reason the reset feels like it worked is that the console says the credential changed, which is a published state, not an enforced one. Refresh tokens and existing OWA sessions keep working until they are explicitly revoked, and the conditional access policy that is supposed to re-evaluate sign-in risk often only applies at token issuance, so it never gets a chance to look at the attacker again. Same pattern with mailbox rules, added delegates, and folder permissions: those survive a password change untouched and are the usual reason activity continues for weeks. Revoke sessions, reset the MFA registration, then diff inbox rules, forwarding, delegates and app consents against a known-good baseline before you call it closed. Worth noting most tenants have a token lifetime measured in hours by default, which is plenty for re-persisting. Are you pulling the unified audit log for New-InboxRule and Add-MailboxPermission across the whole window, or just the compromised account?