Hackers Exploit OAuth Apps to Keep Cloud Access Even After Password Resets

Cybersecurity: Cloud Account Takeover and OAuth Exploitation

Cloud account takeover attacks have advanced beyond basic credential theft. Cybercriminals now exploit OAuth applications to maintain persistent access to compromised environments, effectively bypassing traditional security measures such as password resets and multifactor authentication.

Technical Overview of OAuth Exploitation

These attacks allow malicious actors to hijack user accounts, conduct reconnaissance, exfiltrate data, and execute further malicious activities. Researchers have demonstrated how these attacks can be fully automated, with threat actors actively exploiting these vulnerabilities.

Once access to a cloud account is obtained, attackers can create and authorize internal (second-party) applications with custom scopes and permissions. This enables continuous access to critical resources such as mailboxes and files, circumventing traditional security measures.

In cloud environments like Microsoft Entra ID, it is essential to differentiate between second-party and third-party applications. Second-party applications are registered within an organization's tenant and managed by the organization's administrators or users with appropriate privileges. These applications inherit a level of trust as they originate from within the organization's directory.

Third-party applications are registered in external tenants and request access to resources in other organizations' tenants. They are subject to administrative consent workflows and organizational security policies before access is granted.

Attackers often gain initial access through techniques like reverse proxy toolkits and phishing, which enable credential and session cookie theft. Following initial access, attackers may create malicious OAuth applications, leveraging compromised account privileges to register new internal applications with specific permissions. These applications maintain authorized access even if user credentials are reset or multifactor authentication is enforced.

An automated toolkit has been developed to demonstrate how threat actors establish persistent access through malicious OAuth applications. This tool automates OAuth application registration and configuration, ensuring continuous access independent of user credential changes.

A real-world account takeover incident persisted for four days, detected via a successful login attempt using a user agent signature associated with phishing attacks. The threat actor, operating through VPN proxies, executed actions such as creating malicious mailbox rules and registering internal applications with permissions to maintain access even after password changes.

This case study illustrates the active exploitation of these threats in the current threat landscape.

Based on reporting by GBHackers.