Midweek surge in OAuth consent phishing hits Microsoft 365 and Google Workspace tenants
Marcus Webb ·
Security teams reported a Wednesday spike in OAuth consent phishing against Microsoft 365 and Google Workspace, with adversaries pushing users to approve malicious applications that request broad API scopes. The campaigns target tenants in North America and Europe, enabling mailbox and drive exfiltration and business email compromise setup without stealing passwords.
The tactic matters because a granted consent bypasses multifactor authentication and often survives password resets and device reimaging. Attackers rely on long lived refresh tokens and service principals to maintain access that is difficult to spot through traditional sign in analytics.
Technique and tooling
Lures arrive via email, Teams messages, and ticketing system prompts that lead directly to legitimate Microsoft or Google consent pages. The malicious apps frequently request offline access along with Mail.Read, Files.Read.All, Directory.Read.All, and Gmail or Drive read scopes, then hide behind plausible publisher names and icons. Some clusters abuse the device code flow to avoid URL based phishing defenses and to reduce endpoint telemetry.
After consent, operators use Microsoft Graph and Google APIs to enumerate mailboxes and files, set inbox rules, and subscribe to change notifications for stealthy drip exfiltration. Common Graph patterns include /me/messages with delta queries, /drive/root/children, /subscriptions to webhooks, and creation of new enterprise application assignments. Tradecraft aligns with consent phishing and OAuth abuse previously documented in Midnight Blizzard activity and financially motivated groups tracked for adversary in the middle and BEC operations.
Mitigation and response
Disable user consent and require an admin approval workflow for all third party apps. Restrict app registrations to administrators, require publisher verification, and block unverified or high risk apps with Conditional Access and app governance controls in Microsoft Entra ID and Google Workspace. Limit scopes to least privilege, favor app specific service accounts with time bound access, and enforce continuous access evaluation where supported.
For detection, review ConsentGrant and AppRoleAssignment events, newly created service principals, anomalous Graph or Google API calls from unfamiliar autonomous systems, and sudden spikes in delta syncs. Revoke refresh tokens, delete malicious service principals, remove granted permissions, rotate secrets, and validate that mail forwarding rules and webhook subscriptions are cleared. In Google Workspace, use domain wide app controls to block untrusted apps and the Security Investigation Tool to enumerate and revoke risky tokens.
Identity and SaaS permission governance now sit at the effective perimeter, which shifts investment toward app consent controls, telemetry on API usage, token binding, and automated revocation workflows. Vendors that make OAuth scopes safer by default and expose high fidelity app governance signals will reduce the dwell time of cloud borne intrusions.