APT29 expands Microsoft 365 OAuth abuse with device code phishing as mid‑week surge hits enterprise tenants
Marcus Webb ·
Russian state sponsored group APT29, tracked by Microsoft as Midnight Blizzard, is widening its abuse of OAuth and device code phishing across Microsoft 365 tenants, according to incident responders on Wednesday. The campaign focuses on consent grants and clandestine service principal credentials, which provide durable access to mail and files through Microsoft Graph without deploying endpoint malware.
This matters because the technique survives password resets and bypasses multifactor authentication once tokens and app privileges exist. It also blends into normal cloud traffic, which complicates detection for security operations centers that rely on endpoint telemetry.
How the intrusion chain works
Operators initiate access with consent phishing or the device code flow. Victims are lured to legitimate Microsoft endpoints to enter codes and approve applications that request offline_access, Mail.Read, Files.Read.All, Sites.Read.All, and Directory.Read.All.
With an initial foothold, the actor registers a new application or hijacks an existing service principal in the victim tenant. They add secret or certificate credentials and assign app roles, then use non interactive sign ins to enumerate users, mailboxes, SharePoint, and OneDrive through Graph API.
Persistence relies on refresh tokens and backdoored service principals. The actor seeds inbox rules, sets forwarding, and creates additional app credentials so access survives account remediation. Traffic often routes through residential proxies to mimic employee geolocation.
Mitigation and detection
Disable or restrict user consent in Entra ID and require admin approval for permissions, especially offline_access and read all scopes. Enforce verified publishers for enterprise applications and block device code flow except for an approved list.
Hunt in Entra ID Audit and Sign in logs for Consent to application, Add service principal, Add app role assignment, and Add service principal credentials. Investigate non interactive sign ins by applications from unfamiliar IP ranges and unusual user agents that call Graph mail and files endpoints.
Immediately revoke tokens for impacted users and applications. Remove malicious service principals, delete added credentials, and rotate secrets for legitimate apps. Review Exchange Online logs for New InboxRule and forwarding changes, and reset Conditional Access if exceptions were created.
Enable Continuous Access Evaluation, limit token lifetimes for sensitive scopes, and require compliant devices for Exchange Online and SharePoint. Monitor OAuth apps with high privilege through Cloud App Security tooling and alert on new publisher registrations in the tenant.
The campaign underscores a shift of intrusion tradecraft into identity and SaaS control planes. Organizations that treat Entra ID configuration, audit retention, and app governance as first class attack surface will detect and contain this class of threat faster than those focused only on endpoints and network perimeters.