APT29 revives OAuth consent phishing to persist in Microsoft 365 and Google Workspace

APT29, also tracked as Midnight Blizzard, is running a renewed OAuth consent phishing and token theft campaign against Microsoft 365 and Google Workspace tenants this week, according to incident responders working cases in North America and Europe. The activity uses legitimate authorization flows to obtain powerful scopes and long lived refresh tokens, which provide covert persistence even when passwords and multifactor authentication are intact.

The campaign matters because it bypasses host based defenses and traditional phishing detections, shifting the breach locus into identity and cloud control planes. Teams are finding mailboxes rifled and files exfiltrated without malware on endpoints and with no obvious interactive sign in by a human adversary.

Technique and scope

Operators send consent prompts or device code instructions that lead users to Microsoft or Google authorization endpoints, then request scopes such as Mail.Read, Files.ReadWrite.All, offline_access, and Gmail Modify. In some cases they coerce or phish administrators to create or approve service principals inside the tenant, then assign roles like Application Administrator or grant app roles directly to the attacker controlled service principal.

Once consented, the attacker harvests access and refresh tokens, then calls Microsoft Graph, Exchange Online, or Google APIs to enumerate users, search mail, create inbox rules, and stage data for exfiltration. Persistence hinges on refresh tokens that roll forward until consent is revoked or tokens are explicitly invalidated, and on tenant resident app registrations with secrets or certificates that can last months if not rotated.

Analysts have linked similar cloud only tradecraft to APT29 operations disclosed by Microsoft in 2024, which included password spray, OAuth app abuse, and large scale data theft. Red teams and criminal groups have adopted parallel techniques, including device code phishing that produces no suspicious URL in email content and minimal browser artifacts.

Mitigation path

Disable or restrict device code flow unless required, and block user consent except for verified publishers and low risk scopes with mandatory admin approval. Enforce Conditional Access that evaluates client app type and requires compliant or trusted devices for high impact scopes, and enable Continuous Access Evaluation and token protection features in Entra ID where available.

Inventory and govern service principals and OAuth grants with Microsoft Graph and Defender for Cloud Apps, and enable Google Workspace app access controls with allowlisting. Monitor sign in and audit logs for grant events, unusual service principal activity, and silent Graph or Gmail API access at off hours, then revoke by removing app grants, disabling or deleting the service principal, and forcing refresh token invalidation.

Enterprises should treat cloud identity and app governance as Tier Zero controls. As adversaries lean on first party APIs and standards based flows, detection and response must pivot to identity centric telemetry and policy that binds tokens to device and context rather than trusting consent alone.