Malicious OAuth apps and workload identity abuse are driving current cloud intrusions, defenders say

Security teams entered Wednesday focused on active cloud intrusions that rely on malicious OAuth applications and abuse of workload identities in Microsoft Entra ID and Google Workspace. The activity, documented in recent cases tied to APT29 and multiple criminal groups, grants long lived API access that survives password resets and often evades endpoint controls.

This matters now because the most critical post patch exposure is identity, not a single CVE. Misconfigured consent policies and over privileged service principals create durable backdoors that persist across tenants and tools if not explicitly audited and removed.

How the attacks work

Operators register or compromise an app, then drive user or admin consent for scopes such as offline_access, Mail.Read, Files.Read.All, and Sites.Read.All. With refresh tokens and Graph API permissions, they pull mailboxes and cloud storage through non interactive sign ins, then create additional app secrets to maintain access.

Consent phishing lures impersonate Microsoft or Google prompts and target users who can grant tenant wide access. APT29, also tracked as Midnight Blizzard and Cozy Bear, has repeatedly used this pattern against Microsoft 365 according to prior advisories, mixing token theft and consent abuse to bypass MFA and Conditional Access.

Workload identities are a second persistence layer. Adversaries create or hijack service principals, add application roles, and drop client secrets or certificates. Some cases add federated identity credentials to let external identity providers mint tokens through OIDC, which blends into legitimate automation.

Google Workspace tenants face similar risks through OAuth app abuse and domain wide delegation. Over broad service accounts and unrestricted third party app access enable data exfiltration without interactive logins.

Mitigation and detection

Restrict user consent to verified publishers and require admin approval workflows for all high impact scopes. Enable Microsoft Entra app governance, enforce Conditional Access on all cloud apps including non interactive flows, and apply phishing resistant MFA for administrators.

Continuously audit app registrations and service principals. Remove unused credentials, rotate secrets on a short schedule, and alert on creation of federated identity credentials, new application permissions, and surges in non interactive Graph API calls. In Google Workspace, use App access control, limit domain wide delegation, and monitor OAuth grants in the Security Center.

For incident response, revoke admin consent, delete malicious app registrations, invalidate refresh tokens with tenant wide sign out, and review Unified Audit Logs for consent events and service principal changes. Expect that attackers will attempt reconsent, so block by app ID and implement allow lists where possible.

Identity centric intrusion sets are reshaping enterprise defense. The control plane for cloud access now demands the same rigor historically applied to server hardening and patch cycles, which means consent policy, workload identity hygiene, and telemetry on non interactive access need to be core security engineering tasks.