Active OAuth token theft campaigns target Microsoft 365 and Google Workspace, defenders urged to lock down consent

Threat actors are actively abusing OAuth consent and token theft in Microsoft 365 and Google Workspace, investigators said Wednesday, expanding a tactic that bypasses MFA and enables long term cloud persistence. Campaigns linked to Midnight Blizzard, also known as APT29, and Scattered Spider continue to rely on malicious apps, adversary in the middle phishing, and help desk social engineering to capture session cookies and refresh tokens.

The technique matters because it shifts initial access away from endpoints and toward SaaS control planes, which many enterprises still monitor less rigorously than on premises infrastructure. Once a service principal holds Mail.Read, Files.Read.All, offline_access, or domain wide delegation, attackers can exfiltrate data at scale without tripping endpoint controls.

How the campaign works

Operators phish users through adversary in the middle kits such as EvilProxy and Greatness, or coerce resets through help desks to harvest session cookies and OAuth refresh tokens. They then register or compromise an application, consent to high privilege Graph API scopes, and create persistence by storing refresh tokens that survive password resets and by adding service principals in Entra ID enterprise applications.

In Google Workspace, crews obtain domain wide delegation by tricking admins into allowing an external OAuth client ID, then pull mail and Drive data through Google APIs. Attackers blend sign ins with residential proxies and cloud egress, and they script Graph and Gmail API calls to enumerate mailboxes, rules, and shared drives before bulk exfiltration via rclone or direct API export.

Mitigation and detection path

Restrict consent. In Microsoft Entra ID, require admin consent for all apps, block user consent, and enforce consent policies that only allow verified publishers with least privilege scopes. Enable Conditional Access that requires compliant devices for OAuth app use and disallows risky sign ins. Disable legacy Exchange Online protocols, and turn on Continuous Access Evaluation and token protection where available.

Audit and purge. Review Enterprise applications and App registrations for unverified publishers, excessive Graph scopes, suspicious reply URLs, and anomalous owners. In Entra ID audit logs and the Microsoft 365 Unified Audit Log, hunt for Consent to application, Add service principal, and Update application credentials events, then revoke tokens and rotate client secrets. In Google Workspace, use Admin console API controls to review App access control, remove untrusted clients, and rotate service account keys that have domain wide delegation.

Harden help desks and IdPs. Enforce out of band verification for MFA resets, monitor Okta or Entra ID admin actions, and constrain break glass accounts with just in time elevation and strong phishing resistant MFA like FIDO2. Monitor for anomalous API volumes, OAuth grants outside business hours, and mailbox rule creation that forwards externally.

Cloud identity abuse will continue to compress dwell time from weeks to hours, and it will reward organizations that treat SaaS control planes like production infrastructure with rigorous change control, privileged access management, and continuous audit of non human identities and tokens.