Hackers Exploit OAuth Apps to Keep Cloud Access Even After Password Resets

Cloud account takeover attacks are now leveraging malicious OAuth applications to retain access even after password resets, bypassing MFA and other traditional controls, according to Proofpoint researchers. The attackers register and configure internal, second-party apps with customised permission scopes, enabling persistent access to resources such as mailboxes, SharePoint, OneDrive, Teams, and calendars within the compromised tenant.

A real-world incident observed by Proofpoint telemetry lasted four days, beginning with a login tied to an Adversary-in-the-Middle phishing kit, during which the threat actor created a malicious mailbox rule, registered an internal application named ‘test’, and added application secrets with Mail[.]Read and offline_access permissions.

After the password change, the attackers’ activity continued from VPN proxies, with login attempts from a Nigerian residential IP address, yet the internal application remained active. The article differentiates second-party internal apps from third-party ones, noting threat actors often favour internal applications for post-exploitation persistence that may evade standard external app monitoring. Overall, these findings underscore the need for regular auditing and monitoring of OAuth applications in cloud environments.