Malicious OAuth Applications: The New Stealthy Initial Access Vector in Cyber Attacks

Akshay Jain
Jun 15
3 min read

As organizations move rapidly to cloud-first infrastructures, especially Microsoft 365 and Google Workspace, attackers have shifted tactics. One particularly stealthy and under-reported method of gaining initial access involves malicious OAuth applications.

Unlike traditional phishing or malware delivery, malicious OAuth apps don't require the attacker to steal credentials directly. Instead, they exploit users' trust by tricking them into authorizing rogue applications that grant access to cloud resources.

In this blog, we’ll break down how malicious OAuth apps work, explore a real-world case study, and guide both blue and red teams on how to detect and defend against this emerging threat.

What is OAuth?

OAuth (Open Authorization) is a standard protocol that allows users to grant third-party applications access to their data without sharing their credentials. It’s commonly used to authorize apps to read emails, calendars, files, and contacts in platforms like Microsoft 365 and Google Workspace.

In simple terms, OAuth is a way for one application to access your data on another application without you having to share your password

Example: You connect a calendar tool to your Google account. It asks, “This app wants to access your calendar and email.” If you click "Allow", you're granting an access token to your cloud data.

How Attackers Abuse OAuth

Attack Goal: Gain Persistent, Legitimate Access Without Passwords

Attackers register their own OAuth applications with cloud identity providers. They then craft phishing emails or fake login pages urging users to "Sign in with Google" or "Grant Access" to a seemingly legitimate app.

Key Techniques:

App Registration:
1. Attacker creates a new app with harmless-looking names like "Meeting Scheduler", "PDF Viewer", or "SharePoint Assistant".
2. Requests OAuth scopes such as:
  1. Mail.ReadWrite
  2. Files.Read.All
  3. offline_access (token never expires without revocation)
Phishing for Consent:
1. User receives a link (via email or webpage) prompting them to authorize the app.
2. Once approved, the attacker receives access and refresh tokens.
Persistence:
1. Tokens remain valid even if the user changes their password.
2. MFA is completely bypassed, as the OAuth process is considered “trusted”.

Real-World Case Study: Consent Phishing Campaign on Microsoft 365

In 2020, Microsoft disclosed a widespread consent phishing campaign targeting thousands of users across multiple enterprises. Threat actors registered malicious Azure AD OAuth apps and convinced users to authorize them.

Impact:

Exfiltration of emails, contacts, and files
Persistent access due to offline_access tokens
No detection by traditional AV or EDR
MFA completely bypassed

Malicious OAuth Applications Red Team Simulation: How It’s Done

For ethical simulation purposes (e.g., in a red team engagement):

Register a New App in Azure AD:
1. Go to portal.azure.com
2. Register an app with a benign name
3. Assign API permissions such as:
  1. Mail.ReadWrite
  2. Files.Read.All
  3. User.Read
Create a Consent Link
Deliver via Phishing:
1. Fake login portal or document share invitation
2. Social engineering (e.g. "Grant access to calendar sync")
Capture Tokens and Query Graph API:
1. Use tokens to access user mailboxes, OneDrive, Teams data via Microsoft Graph API.

Blue Team Detection Strategy

Detect Suspicious Consent Grants
1. Enable Microsoft 365 Unified Audit Logs or Google Workspace Admin Audit.
Alert on Risky OAuth Scopes
1. Watch for these OAuth permissions:
  1. Mail.ReadWrite
  2. Mail.Send
  3. Files.ReadWrite.All
  4. Sites.Read.All
  5. offline_access (rarely required by legitimate apps)
Block User Consent for Unverified Apps
1. In Azure AD:
  1. Go to Enterprise Applications → User Settings.
  2. Set "Users can consent to apps accessing company data on their behalf" to No.
  3. Use Admin Consent Workflow for approval.

Indicators of Malicious OAuth Use

Indicator	Description
App with wide permissions	Files.Read.All, Mail.ReadWrite
Unverified publisher	No certificate or domain ownership
Sudden token issuance	Token issued at odd hours
Cross-region access	Token used from country never seen before
No user agent change	API-only access, no user login patterns

The shift to cloud computing has given attackers new tools and OAuth abuse is one of them. It allows initial access without triggering endpoint alarms, bypasses MFA, and provides long-term persistence. Yet many organizations have no alerts configured for it.

Action Steps for Organizations: