OAuth Device Code and Malicious App Abuse to Gain Persistent Access in Microsoft Entra ID/Microsoft 365

Threat actors are increasingly abusing OAuth in Microsoft Entra ID and Microsoft 365 to obtain access/refresh tokens that provide durable access even when passwords are reset and MFA is enabled. Reported activity includes both (1) malicious OAuth app registrations and deceptive consent prompts that masquerade as legitimate “business integrations,” and (2) abuse of the OAuth 2.0 Device Authorization Grant (device code flow) where victims authenticate on Microsoft’s legitimate device login portal, making the intrusion harder to detect with credential-focused controls.

Multiple reports describe campaigns targeting business users and organizations (including technology, manufacturing, and financial sectors) to access resources such as Outlook, Teams, and OneDrive and to enable mailbox actions and data access under seemingly legitimate application activity. Research and incident reporting highlight that attackers can persist via service principals created in victim tenants after consent is granted, and that some integrations may remain effective even if the consenting user is later disabled; separate reporting also describes device-code vishing/phishing that leverages legitimate Microsoft OAuth client IDs and standard login workflows to capture tokens without attacker-hosted phishing pages, with one source attributing the vishing activity to ShinyHunters (unconfirmed by Microsoft at the time of reporting).