Active malicious OAuth app campaigns target Microsoft 365 tenants as APT29 tactics persist
Marcus Webb ·
Security teams are grappling with active abuse of cloud OAuth consent flows against Microsoft 365 tenants, with tactics long associated with APT29, also tracked as Midnight Blizzard, continuing to yield access to email and files. Investigators say adversaries register or compromise apps, secure powerful scopes such as Mail.Read, Files.Read.All, and offline_access, then use long lived refresh tokens to persist without triggering password or MFA challenges.
The activity matters because it is feature misuse rather than a software flaw. There is no CVE to patch, and revoking user passwords does not remove OAuth grants or invalidate application refresh tokens by default.
How the attacks work
Attackers gain initial access through credential theft, password spray, or compromised administrator accounts, then create multi tenant applications or compromise existing service principals. They solicit consent through phishing or grant it themselves if they control a privileged role, often App Admin or Cloud App Admin. With delegated or application permissions in place, they pull mailbox data using Microsoft Graph endpoints such as /me/messages, /users/{id}/messages, and delta queries, or through Exchange Web Services if enabled.
Persistence hinges on refresh tokens tied to the consented app. Adversaries automate token renewal and data pulls from residential proxies to blend with user traffic. Some campaigns exploit device code flow and misconfigured consent policies that allow users to authorize high impact scopes. Others steal app secrets and certificates from source code repositories and CI systems, then impersonate workload identities to access data without user interaction.
Mitigation path for defenders
This is an identity governance problem. Disable user consent to applications, enable an admin consent workflow, and enforce granular app consent policies that limit who can authorize sensitive scopes. Require Conditional Access for workload identities and block legacy protocols such as EWS where possible.
Audit Enterprise Applications for risky permissions, unknown publishers, and multi tenant apps with Mail.Read, EWS.AccessAsUser.All, Files.Read.All, Directory.Read.All, and offline_access. Revoke grants, delete malicious service principals, rotate app secrets and certificates, and invalidate tokens using Entra ID revokeSignInSessions and removal of oauth2PermissionGrants. Monitor Entra ID audit logs for Consent to application events, unusual app registrations, and sign ins by service principals from new locations. Watch for high volume Graph access patterns, atypical user agents, and continuous mailbox enumeration.
Google Workspace administrators should tighten App access control, restrict third party apps to allowlisted publishers, review domain wide delegation, and monitor OAuth token and Access Transparency logs. The broader lesson is clear, cloud compromise increasingly follows identity and permissions, not exploits, so budget and telemetry should shift toward continuous consent governance and workload identity protection.