APT29 expands OAuth consent attacks on Microsoft 365 and Google Workspace, pushing identity defenses to the forefront

Security teams entered Wednesday tracking active OAuth consent abuse against Microsoft 365 and Google Workspace tenants, with activity consistent with Russia linked APT29, also known as Midnight Blizzard. The operators are using malicious cloud applications and long lived refresh tokens to sidestep multifactor authentication, then exfiltrate email and files via official APIs.

The tactic matters because OAuth grants and refresh tokens can survive password resets and standard account lockouts, which gives threat actors durable access to mailboxes and cloud storage. Microsoft and several incident responders documented this technique in 2024 in intrusions that hit Microsoft corporate email and HPE, and researchers say the pattern continues as organizations tighten perimeter patching.

How the campaign works

The intrusion chain typically begins with password spraying or credential phishing against low privilege cloud accounts to gain an initial foothold. The adversary registers or leverages a multitenant app, then tricks users into consenting to high privilege delegated scopes such as Mail.Read, Files.Read.All, Chat.Read, offline_access and full_access_as_user.

Once consent is granted, the attacker exchanges authorization codes for access and refresh tokens, then uses Microsoft Graph and Gmail APIs to pull messages and files without triggering interactive MFA. Adversaries create persistence by adding service principals, seeding additional app secrets, and granting admin consent through compromised administrators. Prior reporting tied APT29 to this OAuth abuse pattern, while a separate China linked group, tracked by Microsoft as Storm 0558, previously demonstrated token forgery against Exchange Online, which underscores the broader identity risk.

Mitigation and detection

Disable user consent tenant wide and require administrator approval, with verified publisher policies for any app that requests high impact scopes. Audit enterprise applications and service principals for newly created objects, unexpected permissions, and anomalous consent events, then revoke grants and refresh tokens for anything suspicious. In Microsoft Entra ID, review Oauth2PermissionGrants, Sign in logs for service principals, and Microsoft 365 Unified Audit logs for MailItemsAccessed and exfiltration via Graph.

Block legacy protocols such as IMAP and POP, shorten token lifetimes where possible, and enforce conditional access with device compliance and phishing resistant MFA such as FIDO2. In Google Workspace, enable OAuth app allowlisting, restrict to trusted client IDs, review Token audit logs, and rotate compromised tokens. Monitor API egress to Graph and Gmail endpoints, and consider app governance controls to flag over privileged applications.

Cloud identity has become the primary battleground for both espionage groups and financially motivated actors, which means least privilege app governance and continuous monitoring of OAuth grants are now core security architecture requirements, not add ons. Vendors are adding app control features, but the operational discipline to review, revoke, and restrict consent is what will blunt these campaigns.