Deconstructing the Tor Exit Node Attack on Microsoft

2 days ago
2 min read

Introduction

As the digital backbone for millions of enterprises, Microsoft Office 365 has become the primary option for modern identity-based warfare. Today’s attackers don't just "log in" they meticulously craft digital fingerprints to mirror legitimate employees, attempting to slip past automated defense unnoticed.

This analysis explores a high-severity incident where a corporate account was compromised through a combination of network anonymization and device metadata manipulation. By dissecting the forensics of a single authentication event, we can see how the attacker attempted to hide within a "trusted" session while inadvertently leaving behind a trail of anomalous technical markers.

Analysis

The incident was first detected by a CyberSift high-priority alert: "O365 Activity from Tor IP Address." While a successful login often signals a routine user session, the platform's correlation engine flagged this specific event due to its high-risk infrastructure and non-standard device signature.

Tor IP anonymization

A forensic look at the user's historical login baseline reveals a standard pattern of access from known corporate subnets. However, the audited event showed a sudden, unexplained shift:

The Infrastructure Shift: The user authenticated from an IP address (45.84.107.17) hosted by QuxLabs AB in Sweden.
The Proxy Layer: Threat intelligence indicates this IP is an active Tor Exit Node, a relay used by threat actors to bounce traffic across the globe, effectively bypassing "Impossible Travel" triggers by appearing from a neutralized geographic location.

Visualizing the deviation from the user's login baseline

Upon further inspection of the IP's reputation, intelligence confirms that this source is not just a proxy, but a known vector for Spam and Windows Exploits. The use of such infrastructure by a standard corporate user is a near-certain indicator of a proxy-based attack.

To conceal the true origin of the request and attempt to bypass Conditional Access, the actor utilized a multi-hop proxy strategy.

MITRE ATT&CK: T1090.003 (Proxy: Multi-hop Proxy)

The Cybersift Advantage

While traditional logs see a "successful login," Cybersift sees the hidden risk. By automatically correlating real-time threat intelligence with user behavioural baselines, our platform identifies the subtle fingerprints of a proxy-based attack, such as Tor exit nodes and manipulated device metadata, that static rules often miss.

The Bottom Line: Without this level of correlation, an attacker using a Tor node might have hours or days of quiet persistence. With Cybersift, the time from initial authentication to high-priority detection is reduced to seconds, enabling teams to revoke sessions before data exfiltration begins.

Conclusion

The persistence of phishing and session theft means that a "successful" login is no longer a guarantee of safety. Organizations must transition from simple identity verification to Continuous Access Evaluation (CAE).

This breach highlights that even when credentials are correct, the context-the network reputation, the device compliance, and the validity of the User-Agent-remains the final line of defense. Swift remediation, including revoking all active sessions and blacklisting anonymizer IPs, is critical to closing the gap before an automated compromise turns into a manual, interactive data breach.

IOCs

Type	IOC
IP Address	45.84.107[.]17
User-Agent	MSAL 1.1.0 (Macintosh; Mac OS X 26_3_0 arm64 en-US) PKeyAuth/1.0
ASN	Tor Exit Node / QuxLabs AB