Active OAuth abuse campaign targets Microsoft 365 tenants, incident responders warn
Marcus Webb ·
Security teams are tracking an active intrusion pattern this week that abuses OAuth app registrations in Microsoft 365 to steal data from cloud mail and storage, according to incident responders working with U.S. and European enterprises. The activity aligns with tactics Microsoft has previously attributed to Midnight Blizzard, also known as APT29, and with copycats who target SaaS identity rather than endpoints.
The timing matters because post Patch Tuesday triage often misses identity layer risks. OAuth abuse persists across password changes and can evade multifactor enforcement, which keeps dwell time high and drives silent exfiltration.
Technique and scope
Attackers obtain initial access through admin credential theft, password spray, or consent phishing that tricks a privileged user into approving a malicious Enterprise application. They register or compromise a service principal, then grant high-risk scopes such as Mail.ReadWrite, Files.Read.All, and offline_access, or Exchange roles like ApplicationImpersonation. They add long lived client secrets or certificates and automate data theft through Microsoft Graph and Exchange Web Services.
Teams report post consent persistence that includes creation of inbound connectors and transport rules in Exchange Online, Graph change notifications for stealthy mailbox syncing, and new app credentials that survive account password resets. Conditional Access often does not cover service principals, which leaves a gap. Microsoft has previously linked similar tradecraft to its own 2023 to 2024 intrusion by Midnight Blizzard, and HPE reported mailbox theft by the same actor in 2023.
Financially motivated groups reuse the pattern for data extortion. The 2024 Snowflake data theft cluster tracked as UNC5537 showed how access via weak or stolen credentials to cloud data platforms can yield mass records at scale. OAuth misuse extends that model to productivity suites.
Mitigation and detection
Set tenant wide app consent to admin only and require publisher verification. Restrict high-risk permissions and use app control in Conditional Access to allow only specific service principals. Disable user consent, enforce phishing resistant MFA for admins, and block legacy protocols like IMAP and POP.
Inventory service principals and granted permissions. Revoke refresh tokens, rotate app secrets and certificates, and remove unnecessary Graph and Exchange roles. Monitor Azure AD audit and sign in logs for consent events, new credentials on service principals, and service principal interactive sign ins. In Microsoft 365 audit, alert on MailItemsAccessed and mass eDiscovery exports. For Google Workspace, enforce third party app restrictions and OAuth token audits.
Edge device exploits still drive initial access. Defenders should continue to prioritize patching for widely exploited CVEs such as CVE-2024-3400 in Palo Alto PAN OS, CVE-2023-4966 in Citrix NetScaler, and CVE-2023-23397 in Microsoft Outlook, then close the identity persistence that follows.
Cloud identity is now the primary attack surface for data theft and extortion. Expect more campaigns that blend old edge exploits with OAuth based persistence, which will push enterprises toward app governance, tighter admin workflows, and hardware backed authentication at the identity provider.