APT29 expands OAuth abuse in Microsoft 365, incident responders flag fresh intrusions Wednesday
Marcus Webb ·
APT29, tracked by Microsoft as Midnight Blizzard, is actively widening its use of OAuth abuse across Microsoft 365 tenants, according to incident responders handling new cases on Wednesday. The group is registering or compromising enterprise applications, harvesting refresh tokens, and using Graph and EWS scopes to exfiltrate mail and files while avoiding endpoint controls. Recent victims include technology and professional services firms in North America and Europe.
The activity matters because it bypasses traditional endpoint and network detections. There is no new vulnerability involved, defenders say the actor is exploiting legitimate identity flows and permissive consent policies to gain durable cloud access.
Tactics focused on OAuth and token theft
Investigators report two dominant entry paths, consent phishing that tricks users or administrators into approving high impact scopes such as offline_access, Mail.ReadWrite, Files.Read.All, and device code flow abuse that masks consent prompts and enables headless approval. Once consented, APT29 registers service principals and adds credentials to persist, including asymmetric keys that extend the lifetime of access via noninteractive client grant tokens.
The group blends this with mailbox and SharePoint reconnaissance through Graph API, creates hidden inbox rules, and stages data in cloud storage. In several cases, the actor chained initial password spray against legacy exposed services with token theft from unmanaged browsers, then pivoted fully to OAuth to evade MFA challenges and conditional access prompts.
Defenders highlight audit artifacts in Entra ID that consistently appear, Consent to application events in Unified Audit Logs, Add service principal and Update application credentials in Directory Audit, and a spike in NonInteractiveUser sign-ins from atypical IP ranges. MailItemsAccessed events provide a trail of post compromise data access.
Immediate steps for defenders
Security teams should immediately suspend self service user consent and require admin approval with publisher verification for all apps. Disable or tightly scope device code flow, and restrict high risk Graph and EWS scopes with app consent policies. Review Enterprise Applications for newly created service principals and high privilege scopes, revoke associated refresh tokens, and remove app credentials.
Enable Conditional Access authentication strengths with phishing resistant methods such as FIDO2 or PIV. Turn on Continuous Access Evaluation and token protection where available to bind tokens to device context. Monitor for risky patterns, noninteractive sign-ins to unfamiliar apps, sudden consent grants, and anomalous service principal activity. Use App Governance to auto quarantine apps that request broad permissions or exhibit abnormal data access.
For the broader technology landscape, the campaign underscores a structural shift where identity and SaaS authorization are the primary battlegrounds. Enterprises that treat OAuth governance as a first class control and enforce publisher verification, least privilege scopes, and strong admin workflows will close off a class of intrusions that tools focused on malware can no longer see.