Microsoft365 Themed Attack Leveraging OAuth Redirection for Account Takeover\u00a0
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Two sophisticated phishing campaigns were observed targeting Microsoft 365 users by exploiting OAuth redirection vulnerabilities combined with brand impersonation techniques.\u00a0<\/p>\n
Threat researchers are warning organizations about these highly targeted attacks designed to bypass traditional security controls and achieve account takeover (ATO).<\/p>\n
The malicious campaigns leverage familiar brands including Adobe and DocuSign to trick users into granting permissions to fraudulent OAuth applications<\/a>.\u00a0<\/p>\n The Proofpoint\u2019s Threat Insight team identified three previously undisclosed malicious OAuth apps disguised as \u201cAdobe Drive,\u201d \u201cAdobe Acrobat,\u201d and \u201cDocuSign\u201d that redirect victims to credential harvesting and malware delivery pages.<\/p>\n \u201cThese sophisticated attackers have altered Microsoft 365 tenant settings and exploited tenant architectures to embed phishing content directly within corporate environments,\u201d Proofpoint said.\u00a0<\/p>\n