APT29 expands OAuth abuse to persist in Microsoft 365, defenders urged to lock down app consent
Marcus Webb ·
APT29, tracked by Microsoft as Midnight Blizzard, is running an active campaign that abuses OAuth in Microsoft 365 to gain and retain access to enterprise email and files. On Wednesday, security teams reported fresh cases across North America and Europe, citing illicit app registrations and consent phishing as the initial access path. The activity matters because it sidesteps password change playbooks and can persist through normal credential resets.
The technique is not a new vulnerability, it is the abuse of legitimate cloud identity features at scale. Once an attacker controlled app is consented, it can obtain refresh tokens and service principal permissions that survive account hygiene unless explicitly revoked.
How the campaign works
Operators register multi tenant apps in their own cloud tenants, then lure users or help desks to grant delegated permissions such as Mail.ReadWrite, Files.Read.All, and offline_access. In some cases they weaponize the device code flow and consent phishing to reduce user friction and to pass MFA at the time of grant.
After consent, the attackers use Microsoft Graph to enumerate mailboxes and SharePoint, set inbox rules, and create webhooks and subscriptions for ongoing exfiltration. Persistence often comes from adding credentials to a service principal, creating secret or certificate credentials, or granting application level roles that do not depend on a single user account.
Investigators report that the adversary renames apps to resemble trusted publishers and targets tenants that allow broad user consent. Audit trails show spikes in OAuth2PermissionGrant and AppRoleAssignment events and non interactive service principal sign ins from cloud hosted IP space.
Mitigation and detection
Disable user consent for apps or restrict it to low risk permissions and enable an admin consent workflow. Require publisher verification, restrict multi tenant app consent, and enforce conditional access on OAuth app sign in where supported. Immediately revoke OAuth grants and service principal credentials during incident response, not just user refresh tokens.
Hunt for newly created service principals with high privilege scopes, consent to unverified publishers, and anomalous Graph API usage. Monitor Entra ID audit logs for application additions, credential changes, and consent grants, and alert on device code flow usage in populations that do not need it. Enable token theft protections and Continuous Access Evaluation to shorten token lifetimes during risk changes.
Cloud identity abuse remains the dominant battleground for enterprise intrusion, and the control plane is the new perimeter. The organizations that treat OAuth governance, conditional access, and app inventory as first class security disciplines will be better positioned than those that only monitor endpoints.