Ongoing Campaign Targets Microsoft 365 to Steal OAuth Tokens and Gain Persistent Access

A sophisticated phishing campaign has been identified targeting Microsoft 365 users. This campaign exploits OAuth tokens to gain persistent access to corporate data, specifically focusing on business users in North America. The attack aims to compromise services such as Outlook, Teams, and OneDrive without directly stealing passwords.

Unlike traditional phishing attacks that use fake login forms, this campaign manipulates victims into completing a legitimate sign-in process on Microsoft’s device login portal. This approach makes detection challenging for both users and basic security tools.

Once the user enters the attacker-supplied device code on the Microsoft device login page, the Microsoft identity platform issues valid OAuth access and refresh tokens linked to the victim’s account. The attacker captures these tokens in real time, enabling them to maintain long-term access without raising typical security alerts.

Organizations impacted by this campaign may notice unauthorized mailbox actions, file access, and potential data exfiltration, all appearing under the guise of legitimate user activity.

The campaign exploits the OAuth Device Authorization Grant flow, which is typically used for devices with limited input capabilities. Attackers repurpose this flow to bypass standard security defenses.

The attacker registers an OAuth application in Microsoft 365 and generates a unique device code mapped to that application. This code is embedded in phishing emails, directing victims to an attacker-controlled landing page where they are prompted to enter their email and follow "secure authentication" steps.

After guiding the victim to the legitimate Microsoft device login portal to submit the provided code, attackers continuously poll the token endpoint and immediately hijack the issued OAuth tokens once Microsoft approves the session.

To mitigate risks associated with such attacks, security teams are advised to:

Block known malicious domains and cloud storage URLs associated with this campaign. Monitor email logs for identified sender addresses and subject patterns. Audit recently consented OAuth applications for suspicious entries. Consider disabling the device code flow or restricting it through Conditional Access policies where business needs permit. Review Azure AD sign-in logs for unusual device code activity and geographic anomalies.

Increasing user awareness around certain phishing themes, such as urgent payment notices and unexpected document shares, can also help detect and prevent OAuth token theft attempts before significant damage occurs.

Based on reporting by Cyber Security News.