Microsoft has disabled multiple fraudulent, verified Microsoft Partner Network accounts for creating malicious OAuth applications that breached organizations' cloud environments to steal email.

Microsoft classifies the attack as "consent phishing" because the attackers use the bogus apps and Azure AD-based OAuth consent prompts (pictured below) to trick targets to grant permissions to ...

The attacks are similar to those reported years ago, indicating that OAuth apps remain an effective way to hijack Microsoft 365 accounts without stealing credentials. Users are advised to be ...

OAuth impersonation for MFA bypass According to Proofpoint, the impersonated apps used convincing names, logos, and permission prompts to trick users into approving access, without raising alarms ...

According to a blog on the company’s website, threat actors satisfied Microsoft’s requirements for third-party OAuth apps by abusing the Microsoft “verified publisher” status, employing ...