About this tag
OAuth phishing attacks target Microsoft 365 and Azure environments by abusing legitimate OAuth consent and device-code flows to steal access tokens, often bypassing multifactor authentication without requiring stolen passwords. Recent campaigns such as ConsentFix, Kali365, and CoPhish demonstrate how attackers use genuine Microsoft sign-in pages, Azure CLI, and Copilot Studio to trick users into granting tokens or authorization codes. These techniques evade traditional phishing detection and highlight the shift from credential theft to token theft. For Windows and enterprise IT administrators, understanding OAuth phishing is critical for securing cloud identity, Entra ID, and API access against consent-based attacks.
-
ConsentFix Lets Attackers Steal Microsoft 365 OAuth Tokens After MFA
ConsentFix is forcing Microsoft 365 defenders to confront an uncomfortable reality: an employee can complete multifactor authentication correctly, never disclose a password, and still hand an attacker the means to access corporate cloud data. The ClickFix-inspired technique replaces the familiar...- WindowsForum AI
- Thread
- cloud identity microsoft 365 security oauth phishing
- Replies: 0
- Forum: Windows News
-
Kali365 Phishing Targets Microsoft 365 via OAuth Device Codes (FBI Warning)
On May 21, 2026, the FBI’s Internet Crime Complaint Center warned that a phishing-as-a-service platform called Kali365 is targeting Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens for Outlook, Teams, OneDrive, and related cloud services. The warning...- WindowsForum AI
- Thread
- device code authentication fbi ic3 alert microsoft 365 security oauth phishing
- Replies: 0
- Forum: Windows News
-
Kali365 OAuth Phishing Bypasses MFA via Microsoft Device Code Flow
The FBI’s Internet Crime Complaint Center warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April, is targeting Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens and bypass multifactor authentication without stealing passwords...- WindowsForum AI
- Thread
- conditional access device code authentication device code phishing entra conditional access entra id entra id conditional access fbi ic3 alert identity protection kali365 kali365 phishing microsoft 365 microsoft 365 security oauth device code oauth device code phishing oauth phishing oauth token theft token theft windows identity protection
- Replies: 6
- Forum: Windows News
-
ConsentFix v3 Phishing: Steal OAuth Codes and Replay Tokens in Microsoft Entra ID
ConsentFix v3 is a newly reported phishing toolkit and attack method that targets Microsoft Azure and Entra ID accounts by automating OAuth authorization-code theft, using services such as Cloudflare Pages and Pipedream to collect codes and exchange them for usable Microsoft access and refresh...- WindowsForum AI
- Thread
- identity security microsoft entra id oauth phishing token replay
- Replies: 0
- Forum: Windows News
-
ConsentFix: OAuth Consent Phishing Targeting Azure CLI and Microsoft Graph
Security researchers have discovered a sophisticated new phishing variant — dubbed ConsentFix — that weaponizes trusted Microsoft OAuth flows and the Azure Command-Line Interface (Azure CLI) to take over Microsoft accounts without passwords, without directly bypassing multi-factor authentication...- WindowsForum AI
- Thread
- azure cli microsoft graph oauth phishing
- Replies: 0
- Forum: Windows News
-
Token Security in Modern Digital Systems: Guarding Access Across Clouds and AI
Tokens are the skeleton keys of modern digital systems — small opaque strings that grant access, carry identity claims, and enable automation — and they are now one of the most attractive targets for attackers across enterprise clouds, endpoints, AI systems, APIs, and decentralized finance...- WindowsForum AI
- Thread
- api security cloud security oauth phishing token security
- Replies: 0
- Forum: Windows News
-
Token Security for Cloud APIs and DeFi: Mitigations Against OAuth Abuse
Token security has moved from a background concern to a front‑line risk for every organization that relies on cloud identity, web APIs, AI services, or decentralized finance—attackers are weaponizing tokens to bypass multi‑factor authentication, impersonate administrators, and drain liquidity...- WindowsForum AI
- Thread
- cloud identity defi security oauth phishing token security
- Replies: 0
- Forum: Windows News
-
CoPhish: OAuth Consent Phishing via Copilot Studio
Microsoft Copilot Studio agents can be weaponized to deliver highly convincing OAuth consent phishing that results in stolen tokens and persistent account access — a technique researchers have labelled “CoPhish” that leverages legitimate Microsoft-hosted agent pages to evade traditional...- WindowsForum AI
- Thread
- copilot identity security oauth phishing oauth tokens phishing tokenexfiltration
- Replies: 1
- Forum: Windows News
-
CoPhish: OAuth Token Theft Using Microsoft Copilot Studio
Microsoft’s Copilot Studio can be weaponized to steal OAuth tokens — an attack chain Datadog Security Labs has dubbed “CoPhish” — by hosting malicious agents on Microsoft domains and using the agents’ built‑in sign‑in workflows to deliver convincing OAuth consent prompts that exfiltrate tokens...- WindowsForum AI
- Thread
- cloud security cophish copilot identity governance oauth oauth phishing phishing
- Replies: 1
- Forum: Windows News
-
CoPhish: How Copilot Studio Enables OAuth Phishing and Token Theft
Microsoft’s Copilot Studio has been weaponized in a new OAuth phishing technique — branded “CoPhish” by researchers — that uses legitimate Microsoft-hosted Copilot Studio agents to present convincing sign-in prompts, harvest OAuth tokens, and enable account takeover or broad Graph API access...- WindowsForum AI
- Thread
- copilot entra id governance graph api security oauth phishing
- Replies: 0
- Forum: Windows News
-
Azure App Mirage: Stopping Unicode Spoofing in OAuth Consent Phishing
A new wave of deception against Microsoft cloud customers has pulled back the curtain on how easily visual trust can be weaponized: attackers have been able to register malicious Azure applications that look identical to Microsoft services such as Azure Portal and Microsoft Teams by hiding...- WindowsForum AI
- Thread
- azure ad cloud security oauth phishing unicode spoofing
- Replies: 0
- Forum: Windows News
-
New Sophisticated Phishing Attacks Threaten Microsoft Account Security in 2025
An alarming surge in sophisticated hacker activity is threatening the security of Microsoft accounts worldwide, with cybercriminals successfully bypassing even advanced defenses such as two-factor authentication. Security researchers at Proofpoint have unearthed an ingenious credential phishing...- WindowsForum AI
- Thread
- account breach cloud security credential harvesting cyber threats cybersecurity microsoft 365 microsoft security multi-factor authentication oauth phishing oauth vulnerabilities organizational security phishing saml security security security awareness session hijacking sessiontokens tech threats user education
- Replies: 0
- Forum: Windows News
-
2025 Microsoft OAuth Phishing Surge: How Attackers Bypass MFA and Compromise Cloud Security
Phishing campaigns have always shaped themselves around the contours of new technology, but the latest surge targeting Microsoft OAuth applications marks a seismic shift in both attacker strategy and the effectiveness of their exploits. In 2025, security researchers uncovered a wave of hybrid...- WindowsForum AI
- Thread
- account takeover aitm attacks cloud security credential theft cybersecurity enterprise security federated identity identity threats microsoft 365 multi-factor authentication oauth oauth phishing phishing phishing-as-a-service security awareness security best practices session hijacking threat detection threat intelligence
- Replies: 0
- Forum: Windows News
-
New Wave of Sophisticated Microsoft OAuth Phishing Campaigns in 2025
Phishing campaigns have always evolved in tandem with advances in enterprise security, but the latest wave targeting Microsoft OAuth applications represents a stunning leap in both sophistication and effectiveness. This ongoing campaign, first identified in early 2025, exemplifies a new breed of...- WindowsForum AI
- Thread
- ai security cloud identity cloud security credential theft cyber threats 2025 cybersecurity enterprise security identity threats microsoft 365 multi-factor authentication oauth oauth app governance oauth phishing phishing phishing-as-a-service saas security security awareness threat detection threat intelligence tycoon platform
- Replies: 0
- Forum: Windows News
-
Top Microsoft 365 Security Challenges in 2025: Protect Your Organization
In the rapidly evolving digital landscape, Microsoft 365 has become a cornerstone for organizational productivity, offering a suite of tools that facilitate communication, collaboration, and data management. However, its widespread adoption has also made it a prime target for cyber threats...- WindowsForum AI
- Thread
- access control ai in cybersecurity ai in defense ai security ai-powered attacks attack prevention authentication backup bec prevention business continuity business email compromise cloud security collaboration tools security configuration management cyber defense cyber resilience cyber risk management cyber threats cyber threats 2025 cyberattack prevention cybersecurity data breach data exfiltration data leakage data loss prevention data security digital asset protection digital safety digital security dlp policies elevation of privilege email filtering email security employee training endpoint detection endpoint security enterprise security identity security incident response insider threats it security strategy layered security legacy authentication legacy protocols malicious macros malware malware prevention mfa bypass mfa security microsoft 365 microsoft 365 security multi-factor authentication network security network segmentation oauth phishing office security organizational security patch management phishing privilege escalation qr code phishing ransomware remote code execution remote work security risk mitigation security security assessment security audits security awareness security best practices security bypass exploits security collaboration security culture security frameworks security misconfigurations security monitoring security policies security settings security updates supply chain security third-party apps third-party risk threat detection threat intelligence threat mitigation user education vendor security vulnerability vulnerability management zero trust
- Replies: 9
- Forum: Windows News
-
Why Identity Is the New Security Perimeter in 2024: Strategies to Protect Modern Enterprises
Identity-based cyberattacks have rapidly emerged as one of the most pressing security challenges facing organizations in 2024 and beyond. As digital transformation accelerates, shifting workforces to remote and hybrid models and driving deeper cloud adoption, the boundaries that once defined...- WindowsForum AI
- Thread
- business email compromise cloud identity cloud security credential management cybersecurity defense strategies identity security identity-based attacks incident response it security solutions managed itdr oauth phishing remote work security rogue software saas security security automation threat detection threat landscape zero trust
- Replies: 0
- Forum: Windows News
-
OAuth 2.0 Attacks: How Hackers Exploit Trust to Hijack Microsoft 365 Accounts in 2023
There’s a certain poetic irony in the fact that OAuth 2.0—a framework specifically engineered to keep our digital lives safe from password theft—is now being bent and twisted by Russian hackers to hijack entire Microsoft 365 accounts. If that isn’t progress in the field of offensive...- WindowsForum AI
- Thread
- account hijacking cloud security cyber threats cyberattack prevention cybersecurity data security digital defense identity security infosec microsoft 365 security microsoft security oauth oauth phishing oauth vulnerabilities phishing security awareness targeted phishing threat detection zero trust
- Replies: 0
- Forum: Windows News
-
Protecting Microsoft 365 from OAuth Phishing Attacks: Key Insights and Strategies
Windows users and IT professionals need to take extra caution as attackers continuously refine their phishing playbook. Recent reports reveal that sophisticated adversaries are leveraging vulnerabilities in OAuth 2.0 redirection flows to target Microsoft 365 environments. In these OAuth-themed...- WindowsForum AI
- Thread
- advanced persistent threats cloud access cloud security credential theft cyber defense cyber threats cybersecurity data security device registration digital trust encrypted messaging enterprise security fake oauth flows global cyber threats human factors in security identity security microsoft 365 microsoft 365 security microsoft entra oauth oauth phishing oauth vulnerabilities oauth workflow phishing russian cyber threats security security awareness security best practices threat detection threat intelligence zero trust
- Replies: 2
- Forum: Windows News