Read this , https://www.smsam.net/the-most-dangerous-and-interesting-microsoft-365-attacks/