Phishing Attack Hijacks Office 365 Accounts Using OAuth Apps

guest · Dec 10, 2019

Phishing Attack Hijacks Office 365 Accounts Using OAuth Apps
December 10, 2019
https://www.bleepingcomputer.com/ne...hijacks-office-365-accounts-using-oauth-apps/

A phishing campaign has been discovered that doesn't target a recipient's username and password, but rather uses the novel approach of gaining access to a recipient's Office 365 account and its data through the Microsoft OAuth API.

In a phishing campaign discovered by threat intelligence and mitigation firm PhishLabs, attackers are no longer targeting a user's login credentials, but are now using Microsoft Office 365 OAuth apps to hijack a recipient's account.

"This attack method is unique in that it's effectively malware targeting a victim's Office 365 account. It's highly persistent, will completely bypass most traditional defensive measures, and is difficult to detect and remove unless you know what you're looking for. It's really quite clever, and extremely dangerous," PhishLabs' Michael Tyler told BleepingComputer in conversations.
Checking for malicious OAuth apps
As Office 365 OAuth apps can give attackers complete access to an Office 365 account, they can be used for a variety of attacks. For example, a proof-of-concept ransomware was created that utilized an OAuth app to encrypt email in a test Office 365 account.

For this reason, PhishLabs suggests that Office 365 administrators restrict the ability for users to install Apps that are not whitelisted by the administrator.
Click to expand...

PhishLabs: Phishing Campaign Uses Malicious Office 365 App

guest · Jul 8, 2020

Microsoft warns of Office 365 phishing via malicious OAuth apps
July 8, 2020
https://www.bleepingcomputer.com/ne...office-365-phishing-via-malicious-oauth-apps/

Microsoft warns that with the shift to remote working, customers are exposed to additional security threats such as consent phishing, besides conventional credential theft and email phishing attacks.

Consent phishing is a variant of application-based attack where the targets are tricked into providing malicious Office 365 OAuth applications (web apps registered by the attackers with an OAuth 2.0 provider) access to their Office 365 accounts.

"While application use has accelerated and enabled employees to be productive remotely, attackers are looking at leveraging application-based attacks to gain unwarranted access to valuable data in cloud services," Microsoft Partner Group PM Manager Agnieszka Girling said.
Legal action to dismantle attack infrastructure
BleepingComputer previously reported on the inner-workings of a consent phishing attack in December 2019, explaining how this made it possible for the attackers to hijack their victims' Office 365 accounts.
Click to expand...

Recently, Microsoft observed multiple phishing campaigns launching consent phishing application-based attacks against its customers with the end goal of taking control of the Microsoft accounts, stealing sensitive data, and later using it to defraud organizations as part of Business Email Compromise (BEC) fraud schemes.

"Once victims clicked on the deceptive links, they were ultimately prompted to grant access permissions to a malicious web application (web app)," Microsoft Corporate Vice President for Customer Security & Trust Tom Burt said.
Consent phishing defense measures
Individual users can easily check if they have any user consent apps or services tied to their accounts by going here.
To remove a listed consent, click on its entry, and on the page that opens, click on the 'Remove these permissions' button to remove it.
Click to expand...

guest · Oct 1, 2020

OAuth Consent Phishing Ramps Up with Microsoft Office 365 Attacks
September 30, 2020
https://threatpost.com/oauth-phishing-microsoft-o365-attacks/159713/

An APT known as TA2552 has been spotted using OAuth2 or other token-based authorization methods to access Office 365 accounts, in order to steal users’ contacts and mail.

According to researchers from Proofpoint, targets receive a well-crafted lures asking them to click a link which carries them to the legitimate Microsoft third-party apps consent page.

“Once signed into their O365 (Office 365) account, the user is redirected to the official O365 consent process that prompts them to grant permissions to the actor’s application,” they explained. “The domains that catch the OAuth tokens are often registered via Namecheap and hosted on Cloudflare.”
There, they’re asked to grant read-only permissions to a (malicious) third-party application that’s masquerading as a real organization’s app.

“Even read-only access comes with considerable risk,” according to a Proofpoint posting on Tuesday.
Click to expand...

Proofpoint researchers said that organizations worldwide have received messages, but TA2552 seems to favor Spanish speakers in Mexico for this effort. For instance, the impersonation of the Servicio de Administración Tributaria (SAT), Mexico’s tax authority, is a common message theme.

“The access token is used to make API calls on behalf of the user. If the user accepts, the attacker can gain access to their mail, forwarding rules, files, contacts, notes, profile and other sensitive data and resources.”
Users can protect themselves by ensuring that whatever app they’re signing into is actually legitimate.
Click to expand...

Proofpoint: TA2552 Uses OAuth Access Token Phishing to Exploit Read-Only Risks

Threat actors often find creative ways to harvest information. In these attacks, TA2552 doesn't rely on techniques like more traditional credential phishing or dropping malware on a system. Instead, they gain permissions to view the content and activity of resources available through a user’s O365 account.

The ability to perform reconnaissance on an O365 account supplies an actor with valuable information that can later be weaponized in business email compromise (BEC) attacks or account takeovers.
Click to expand...

guest · Oct 19, 2020

Coinbase phishing hijacks Microsoft 365 accounts via OAuth app
October 19, 2020
https://www.bleepingcomputer.com/ne...hijacks-microsoft-365-accounts-via-oauth-app/

A new phishing campaign uses a Coinbase-themed email to install an Office 365 consent app that gives attackers access to a victim's email.
Over the past year, hackers have increasingly used Microsoft Office 365 OAuth apps, otherwise known as consent apps, as part of their attacks.
Coinbase phishing pushes an Office 365 consent app
Unfortunately, when someone makes something helpful, threat actors always attempt to abuse them for malicious purposes.
Such is the case with a phishing campaign that pretends to be a "New terms of service" that Coinbase users must read and accept to continue using the service.
Click to expand...

When accepting the account, they can perform actions or see data based on the corresponding permissions of the app [...]
Once the Office 365 user clicks on the 'Yes' button, the threat actors will have full access to read the accounts profile and their email.
Click to expand...

Log in or Sign up

Phishing Attack Hijacks Office 365 Accounts Using OAuth Apps

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Phishing Attack Hijacks Office 365 Accounts Using OAuth Apps

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches