Hackers Using OAuth Apps in Microsoft Entra ID to Establish Persistence
Recent findings highlight the increasing abuse of OAuth applications within Microsoft Entra ID by malicious actors to establish persistent access. These applications are disguised as legitimate business integrations, allowing unauthorized access even…
Recent findings highlight the increasing abuse of OAuth applications within Microsoft Entra ID by malicious actors to establish persistent access. These applications are disguised as legitimate business integrations, allowing unauthorized access even after password resets.
Research indicates that attackers are leveraging fake OAuth apps, misleading consent prompts, and redirect URLs to steal tokens and maintain long-term presence in Microsoft 365 environments. This technique involves creating an application object in the app’s “home” tenant, which serves as a blueprint for service principals in other tenants where the app is deployed.
A service principal acts as the app’s local identity in a tenant, defining its permissions and access to resources. Attackers exploit this model by tricking users or admins into granting consent to malicious OAuth apps, creating a persistent access pathway.
According to MITRE, adversaries can maintain access through OAuth app integrations by obtaining consent from high-privileged accounts. This access path remains viable even if the original consenting account is disabled, potentially bypassing multi-factor authentication (MFA) via application access tokens.
Recent findings highlight the increasing abuse of OAuth applications within Microsoft Entra ID by malicious actors to establish persistent access.
Wiz has developed a detection pipeline named “OAuth Apps Scout” to identify emerging malicious OAuth applications. Recent threat reporting linked fake Microsoft OAuth applications to attacks conducted in early 2025, where impersonated apps led victims into phishing flows using kits like Tycoon.
Proofpoint reported that nearly 3,000 user accounts across more than 900 Microsoft 365 environments were targeted in 2025, with a confirmed compromise success rate exceeding 50%.
To mitigate these threats, Microsoft’s consent model allows administrators to enforce conditions requiring approval for app consent. Implementing an admin consent workflow can shift risky authorization decisions to designated reviewers. Organizations should treat OAuth apps and service principals as inventory, requiring continuous evaluation.
Special attention should be given to new or uncommon apps, unusual redirect URLs, and permissions that do not align with the app's stated purpose.
Based on reporting by Cyber Security News.