Investigating SharePoint Phishing Activity Caused by Token Theft from a Compromised Website
Because the attacker is replaying a valid session token rather than logging in, standard MFA controls do not block the activity.
🔍 Symptoms
⚠️ What You May Experience
- Users receiving unexpected SharePoint file-sharing emails they did not initiate
- Microsoft Purview Audit Logs showing file operations under user identity
- Suspicious links redirecting to malicious scripts instead of SharePoint documents
- No direct login anomalies detected — MFA bypass suspected
🧠 Root Cause
💡 Token Theft Attack Chain
- The organization’s public website was compromised
- Malicious scripts were injected into web pages, enabling credential harvesting or session token theft
- Attackers used stolen session tokens to access Microsoft 365 without authentication prompts and perform SharePoint / OneDrive file-sharing operations under the victim’s identity
- Result: users received phishing emails with tampered sharing links
⚠️ Why Standard MFA Doesn’t Block This
The attacker is replaying a valid, already-authenticated session token — no new login is attempted. MFA is only challenged at authentication time, not during token replay. Continuous Access Evaluation (CAE) is required to detect and revoke tokens in near real-time.
🛠️ Step-by-Step Resolution
Revoke Active Sessions — Critical Containment
Immediately invalidate all active tokens for affected users. This is the highest-priority step — perform it before any investigation to cut off attacker access.
Connect-MgGraph -Scopes "User.ReadWrite.All" # Revoke all active sessions (invalidate tokens) Revoke-MgUserSignInSession -UserId "user@yourdomain.com"
Force Password Reset
Reset credentials to ensure the attacker cannot re-authenticate even if they attempt to use harvested credentials.
Update-MgUser -UserId "user@yourdomain.com" -PasswordProfile @{ ForceChangePasswordNextSignIn = $true Password = "TempStrongPassword123!" }
Investigate SharePoint Activity via Audit Logs
Pull audit logs to understand the full scope of file access and sharing performed under the compromised identity.
Connect-MgGraph -Scopes "AuditLog.Read.All" # Retrieve file and sharing activities Get-MgAuditLogDirectoryAudit | Where-Object { $_.ActivityDisplayName -match "File" -or $_.ActivityDisplayName -match "Sharing" }
✅ Also Check in Microsoft Purview
- Go to Microsoft Purview Portal → Audit → New Search
- Filter by: Activities → SharePoint file operations, sharing invitations
- Filter by: Users → affected accounts
- Review timestamps, IP addresses, and device details for anomalies
Validate SharePoint Sharing Configuration
Review tenant-wide sharing settings to identify overly permissive configurations that may have enabled external sharing.
Connect-SPOService -Url https://yourtenant-admin.sharepoint.com # Check tenant sharing settings Get-SPOTenant | Select SharingCapability # List all site collections and their sharing levels Get-SPOSite | Select Url, SharingCapability
Secure the Compromised Website
Remove all injected scripts from the public website and implement controls to prevent reinfection.
✅ Website Remediation Checklist
- Remove all malicious or injected scripts from web pages
- Reset all admin and hosting credentials
- Patch CMS, plugins, and frameworks to latest secure versions
- Implement a Web Application Firewall (WAF)
- Enable malware scanning (scheduled and on-demand)
- Configure file integrity monitoring to detect future injections
Endpoint and User Investigation
Scan affected systems and review Entra ID sign-in logs for evidence of further compromise.
💡 What to Check
- Scan all affected systems for malware and keyloggers
- Remove suspicious or unauthorised browser extensions
- Review Entra ID sign-in logs for unusual IP addresses, new or unrecognised devices, and token replay patterns (same token used from multiple IPs)
User Awareness
Communicate the incident to affected users and reinforce safe browsing practices.
✅ Communication Steps
- Inform affected users about the malicious sharing links and advise them not to click
- Confirm which users accessed the suspicious URLs and assess further exposure
- Reinforce secure browsing practices — risks of visiting unverified sites while signed into Microsoft 365
💡 Best Practices / Recommendations
- Enable Conditional Access policies with session controls to restrict token reuse from unfamiliar locations or devices
- Implement phishing-resistant MFA (FIDO2 / certificate-based) — standard TOTP MFA does not protect against token theft
- Enable Continuous Access Evaluation (CAE) so token revocation takes effect in near real-time across Microsoft 365
- Restrict external sharing in SharePoint to the minimum required for business needs
- Regularly monitor audit logs and user activity in Microsoft Purview for anomalous file-sharing patterns
📚 References & Further Reading
- 🔗 Search the audit log in Microsoft Purview — Microsoft Learn
- 🔗 External sharing overview in SharePoint — Microsoft Learn
✅ Key Takeaway
When SharePoint file-sharing activity appears under a user’s identity without their knowledge, token theft via a compromised website is the most likely cause. The immediate priority is revoking all active sessions, followed by securing the compromised website and enabling CAE and phishing-resistant MFA to prevent recurrence.