One incident happened where a user in my company complained that phishing emails were being sent from her O365 account. When I analyzed the PCAP, I noticed a connection established using STUN. It seems the intruder may have sent a link, and the user ...