Loading story…
Praetorian reported an attack chain in which adversaries combine two seemingly lower-severity weaknesses—abusable public-facing email/newsletter API endpoints and verbose error handling that leaks OAuth 2.0 bearer tokens—to achieve high-impact compromise. In the first step, attackers manipulate unauthenticated JSON parameters (e.g., recipient, subject, body) in business-logic-driven endpoints (such as newsletter signups/contact forms/password resets) to force an organization’s own infrastructure to send attacker-crafted emails. Because the messages are sent by authorized systems, they pass SPF/DKIM/DMARC checks and are more likely to land in users’ primary inboxes, effectively turning trusted infrastructure into a phishing delivery mechanism.
The second step escalates impact when malformed requests (including incomplete or invalid JSON) trigger debugging responses that return stack traces and inadvertently expose OAuth access tokens used by internal services. With stolen tokens—often usable against Microsoft Graph depending on configured scopes—attackers can access Microsoft 365 resources without needing user credentials, potentially enabling broad tenant compromise. The reporting emphasizes that the protocols (SPF/DMARC) are not “broken”; rather, attackers are exploiting legitimate sending paths and poor error hygiene, illustrating how vulnerability chaining can turn medium/low issues into a critical compromise path.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A follow-up report highlighted that combining phishing delivery weaknesses with OAuth token flaws can lead to full Microsoft 365 compromise. The coverage reinforced the impact of the attack path involving trusted email delivery and abuse of valid Microsoft Graph access tokens.
Praetorian published research describing how attackers can chain unauthenticated email-sending flaws with OAuth token exposure to compromise Microsoft 365 accounts. The write-up explained that phishing emails sent through a victim organization's own mail infrastructure can pass SPF, DKIM, and DMARC, then be combined with leaked or intercepted access tokens for broader access.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with `Exchange.ManageAsApp` and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments. Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Aug 15, 2026
Threat actors are increasingly leveraging OAuth 2.0 device code authorization flows to compromise Microsoft 365 accounts through sophisticated phishing campaigns. Proofpoint researchers have observed both state-aligned and financially motivated groups using social engineering tactics to trick users into granting access to malicious applications, resulting in account takeovers, data exfiltration, and broader SaaS supply chain abuse. Attackers initiate these campaigns with phishing messages containing URLs or QR codes that, when followed, prompt users to authorize access for rogue applications, ultimately handing over OAuth tokens to the adversaries. Industry analysis highlights that identity-first intrusions, including device code flow phishing and illicit OAuth consent, have driven significant data breaches and business email compromise incidents in 2025. Notable cases include the exploitation of connected apps to exfiltrate data from Salesforce tenants and major financial impacts on organizations such as Marks & Spencer. Security experts recommend enforcing phishing-resistant MFA, governing OAuth consent, and deprecating device code flows where feasible to mitigate these risks. Regulatory changes are also pushing organizations to strengthen identity and SaaS governance in response to these evolving threats.
Aug 14, 2026