AiTM Session Accesses Both Mail and File Services

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•4•0•6

Detects a single new session identifier accessing Exchange, SharePoint, and OneDrive within a short period, which may indicate broad post-authentication collection following an adversary-in-the-middle (AiTM) attack.