Azure Apps Vulnerability Lets Hackers Create Malicious Apps Mimicking Microsoft Teams
Microsoft Azure's security vulnerabilities allow cybercriminals to create deceptive applications that mimic official services such as the "Azure Portal." The flaws were identified by Varonis, who discovered that Azure's safeguards against reserved names…
Microsoft Azure's security vulnerabilities allow cybercriminals to create deceptive applications that mimic official services such as the "Azure Portal." The flaws were identified by Varonis, who discovered that Azure's safeguards against reserved names for cross-tenant apps could be circumvented using invisible Unicode characters.
By embedding characters like the Combining Grapheme Joiner (U+034F) within names like "Azure Portal," attackers were able to create apps that appeared legitimate on consent screens. This technique was successful with over 260 such characters, exploiting the absence of verification badges on many Microsoft apps, which often leads users to ignore warnings about third-party origins.
Azure applications, which integrate with Azure services , depend on user consent for permissions. Delegated permissions allow apps to act on a user's behalf, accessing emails, files, and more, while application permissions provide standalone access.
When abused, these permissions serve as potent attack vectors for initial access, persistence, and privilege escalation in Microsoft 365 environments. Varonis focused on initial access methods, particularly illicit consent grants and device code phishing. In the former, phishing emails lure victims to fake file links that redirect to a consent page.
Azure applications, which integrate with Azure services , depend on user consent for permissions.
Once consent is granted, attackers obtain access tokens, granting them resource privileges without requiring passwords. Device code phishing involves generating a verification URI and code for a malicious app, tricking users into entering it on a legitimate-looking site. The attacker then polls for the token, hijacking the session.
These techniques rely on deception, with consent pages for spoofed apps displaying convincingly, especially when paired with Azure icons. Discussions reveal users often dismiss "unverified" alerts, assuming they are safe from Microsoft itself.
Prohibited names tested included common services like "Microsoft Teams," "Power BI," and "OneDrive SyncEngine," highlighting the potential for impersonation. Varonis promptly disclosed the issues, leading to Microsoft fixing the initial Unicode bypass in April 2025 and a broader set in October 2025.
While no customer action is required due to automatic updates safeguarding tenants, experts recommend that organizations monitor app consents rigorously, enforce least-privilege permissions, and educate users on phishing red flags. This incident underscores the necessity for layered defenses in cloud environments. As attackers evolve, vigilance is essential to prevent seemingly benign app consents from becoming security risks.
Based on reporting by Cyber Security News.