oauth phishing

About this tag
OAuth phishing is a growing threat that targets Microsoft 365, Azure, and Entra ID accounts by abusing legitimate OAuth authentication flows to steal access tokens, bypass passwords, and evade multifactor authentication. Recent attacks such as Kali365 use device-code authentication to capture tokens without requiring stolen credentials or fake login pages, while ConsentFix v3 automates OAuth authorization-code theft via Cloudflare Pages and Pipedream. CoPhish exploits Microsoft Copilot Studio to deliver consent prompts that exfiltrate tokens. These attacks shift the phishing battlefield from passwords to tokens, making traditional anti-phishing advice insufficient. Windows shops must adopt token security measures to defend against OAuth abuse.
  1. Kali365 Phishing Targets Microsoft 365 via OAuth Device Codes (FBI Warning)

    On May 21, 2026, the FBI’s Internet Crime Complaint Center warned that a phishing-as-a-service platform called Kali365 is targeting Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens for Outlook, Teams, OneDrive, and related cloud services. The warning...
  2. Kali365 OAuth Phishing Bypasses MFA via Microsoft Device Code Flow

    The FBI’s Internet Crime Complaint Center warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April, is targeting Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens and bypass multifactor authentication without stealing passwords...
  3. ConsentFix v3 Phishing: Steal OAuth Codes and Replay Tokens in Microsoft Entra ID

    ConsentFix v3 is a newly reported phishing toolkit and attack method that targets Microsoft Azure and Entra ID accounts by automating OAuth authorization-code theft, using services such as Cloudflare Pages and Pipedream to collect codes and exchange them for usable Microsoft access and refresh...
  4. ConsentFix: OAuth Consent Phishing Targeting Azure CLI and Microsoft Graph

    Security researchers have discovered a sophisticated new phishing variant — dubbed ConsentFix — that weaponizes trusted Microsoft OAuth flows and the Azure Command-Line Interface (Azure CLI) to take over Microsoft accounts without passwords, without directly bypassing multi-factor authentication...
  5. Token Security in Modern Digital Systems: Guarding Access Across Clouds and AI

    Tokens are the skeleton keys of modern digital systems — small opaque strings that grant access, carry identity claims, and enable automation — and they are now one of the most attractive targets for attackers across enterprise clouds, endpoints, AI systems, APIs, and decentralized finance...
  6. Token Security for Cloud APIs and DeFi: Mitigations Against OAuth Abuse

    Token security has moved from a background concern to a front‑line risk for every organization that relies on cloud identity, web APIs, AI services, or decentralized finance—attackers are weaponizing tokens to bypass multi‑factor authentication, impersonate administrators, and drain liquidity...
  7. CoPhish: OAuth Consent Phishing via Copilot Studio

    Microsoft Copilot Studio agents can be weaponized to deliver highly convincing OAuth consent phishing that results in stolen tokens and persistent account access — a technique researchers have labelled “CoPhish” that leverages legitimate Microsoft-hosted agent pages to evade traditional...
  8. CoPhish: OAuth Token Theft Using Microsoft Copilot Studio

    Microsoft’s Copilot Studio can be weaponized to steal OAuth tokens — an attack chain Datadog Security Labs has dubbed “CoPhish” — by hosting malicious agents on Microsoft domains and using the agents’ built‑in sign‑in workflows to deliver convincing OAuth consent prompts that exfiltrate tokens...
  9. CoPhish: How Copilot Studio Enables OAuth Phishing and Token Theft

    Microsoft’s Copilot Studio has been weaponized in a new OAuth phishing technique — branded “CoPhish” by researchers — that uses legitimate Microsoft-hosted Copilot Studio agents to present convincing sign-in prompts, harvest OAuth tokens, and enable account takeover or broad Graph API access...
  10. Azure App Mirage: Stopping Unicode Spoofing in OAuth Consent Phishing

    A new wave of deception against Microsoft cloud customers has pulled back the curtain on how easily visual trust can be weaponized: attackers have been able to register malicious Azure applications that look identical to Microsoft services such as Azure Portal and Microsoft Teams by hiding...
  11. New Sophisticated Phishing Attacks Threaten Microsoft Account Security in 2025

    An alarming surge in sophisticated hacker activity is threatening the security of Microsoft accounts worldwide, with cybercriminals successfully bypassing even advanced defenses such as two-factor authentication. Security researchers at Proofpoint have unearthed an ingenious credential phishing...
  12. 2025 Microsoft OAuth Phishing Surge: How Attackers Bypass MFA and Compromise Cloud Security

    Phishing campaigns have always shaped themselves around the contours of new technology, but the latest surge targeting Microsoft OAuth applications marks a seismic shift in both attacker strategy and the effectiveness of their exploits. In 2025, security researchers uncovered a wave of hybrid...
  13. New Wave of Sophisticated Microsoft OAuth Phishing Campaigns in 2025

    Phishing campaigns have always evolved in tandem with advances in enterprise security, but the latest wave targeting Microsoft OAuth applications represents a stunning leap in both sophistication and effectiveness. This ongoing campaign, first identified in early 2025, exemplifies a new breed of...
  14. Top Microsoft 365 Security Challenges in 2025: Protect Your Organization

    In the rapidly evolving digital landscape, Microsoft 365 has become a cornerstone for organizational productivity, offering a suite of tools that facilitate communication, collaboration, and data management. However, its widespread adoption has also made it a prime target for cyber threats...
  15. Why Identity Is the New Security Perimeter in 2024: Strategies to Protect Modern Enterprises

    Identity-based cyberattacks have rapidly emerged as one of the most pressing security challenges facing organizations in 2024 and beyond. As digital transformation accelerates, shifting workforces to remote and hybrid models and driving deeper cloud adoption, the boundaries that once defined...
  16. OAuth 2.0 Attacks: How Hackers Exploit Trust to Hijack Microsoft 365 Accounts in 2023

    There’s a certain poetic irony in the fact that OAuth 2.0—a framework specifically engineered to keep our digital lives safe from password theft—is now being bent and twisted by Russian hackers to hijack entire Microsoft 365 accounts. If that isn’t progress in the field of offensive...
  17. Protecting Microsoft 365 from OAuth Phishing Attacks: Key Insights and Strategies

    Windows users and IT professionals need to take extra caution as attackers continuously refine their phishing playbook. Recent reports reveal that sophisticated adversaries are leveraging vulnerabilities in OAuth 2.0 redirection flows to target Microsoft 365 environments. In these OAuth-themed...