AiTM sign-in via error 50074/50140 followed by rapid app enumeration

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects evidence of an Adversary-in-the-Middle (AiTM) phishing attack where a user sign-in results in specific error codes (50074: MFA required; 50140: Keep-me-signed-in interrupted), followed by rapid enumeration of key M365 applications (OfficeHome, My Apps, My SignIns) using the same session/user-agent, signifying post-authentication reconnaissance via stolen tokens.