New Phishing Wave Uses OAuth Prompts to Take Over Microsoft Accounts

A new phishing campaign is targeting Microsoft account holders by using a clever twist on OAuth authentication prompts. Instead of asking users to hand over their passwords directly, attackers are tricking people into granting permission to malicious applications through legitimate-looking Microsoft authorization screens. This method bypasses traditional password protection and multi-factor authentication, making it particularly dangerous for targeted users and organisations, including business accounts.

Victims receive phishing emails directing them to click links that lead to fake or compromised OAuth consent screens, and when they follow the link they are presented with a Microsoft login page that looks authentic, followed by a standard OAuth permission prompt. According to Unit 42, recent campaigns abuse OAuth flows to hijack Microsoft accounts, with attackers impersonating major business platforms to obtain access tokens that grant full account control.

Organisations should monitor unusual OAuth token usage and suspicious application permissions, while users are advised not to click unexpected links and to review permission requests carefully before granting access.