APT29 expands Microsoft 365 OAuth abuse, adds device code flow and service principal hijacking for persistence
Marcus Webb ·
Russian state linked APT29 is running an active intrusion campaign against Microsoft 365 tenants, security teams reported Wednesday, abusing OAuth consent phishing and the device code flow to obtain long lived cloud tokens. The group, also tracked as Midnight Blizzard, is targeting enterprises in North America and Europe to exfiltrate mail and files while maintaining tenant level persistence.
The tactic matters because it sidesteps traditional patching and endpoint defenses, and it often bypasses multi factor authentication by operating through trusted app permissions. The persistence layer lives in Entra ID, not on individual hosts, which complicates detection and response.
Attackers begin with password spray against low privilege accounts, then trigger user consent prompts that request Graph scopes such as offline_access, Mail.ReadWrite, Files.ReadWrite.All, EWS.AccessAsUser.All, and Sites.Read.All. If users cannot consent, the operators pursue admin accounts or exploit weak consent policies to land an administrator approval, which grants refresh tokens that survive password resets.
Responders are also seeing service principal hijacking. After compromising a privileged account, the actors add new client secrets or certificates to existing enterprise applications, or create shadow applications, then grant AppRoleAssignments with high value application permissions such as full_access_as_app in Exchange Online. This creates non interactive access paths that do not appear in normal user sign in dashboards.
Exfiltration runs through Graph API, EWS, and SharePoint endpoints, often originating from residential proxy infrastructure to blend with user traffic. Indicators include sudden AddOAuth2PermissionGrant and Add service principal events in Entra ID AuditLogs, new KeyCredential entries on high privilege apps, anomalous DeviceCode sign ins, and spikes in MailItemsAccessed and FileAccessed events.
Mitigation requires identity configuration, not only patching. Disable user consent or allow consent only for verified publishers and pre approved apps, and enable the admin consent workflow. Review and restrict high risk Graph scopes, enforce conditional access to block device code flow for non managed locations, and require phishing resistant authentication for all administrators. Regularly export and review OAuth2 permission grants and AppRoleAssignments, rotate app credentials, revoke inactive refresh tokens, and audit service principals for unexpected keys or owners.
Security operations can hunt by querying Entra ID AuditLogs for application credential changes and new consent grants, and by correlating these with Exchange and SharePoint access patterns. Immediate response should include revoking suspect app grants, deleting rogue service principals, rotating credentials on legitimate apps, and invalidating refresh tokens.
The campaign underscores a broader shift in enterprise risk from endpoint exploits to cloud control plane abuse. Identity hygiene, consent governance, and continuous monitoring of application permissions now sit alongside vulnerability management as first tier controls.