Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Craig Hale

Microsoft says criminals are misusing OAuth apps to launch scam attacks

Crypto mining.

Microsoft says its Threat Intelligence team has been observing financially motivated attacks and scams using OAuth apps as automation tools.

In a new post, the team explained how threat actors have compromised user accounts to create, modify, and grant high privileges to OAuth apps to hide malicious activity.

Fortunately, the scale of the attacks has been measured by means of account protection – attackers have been targeting user accounts without strong authentication mechanisms – which at least gives users and admins some hope to apply further protection against the scams.

Is your account securely protected?

Microsoft said that threat actors mostly launched their attacks via phishing or password spraying methods. They then went on to misuse OAuth apps with high privilege permissions for a variety of reasons.

A group tracked as Storm-1283 (the Storm prefix suggests that this is currently a low-scale group that’s in developed rather than a long-standing threat actor) was caught signing in via a VPN and creating a new single-tenant OAuth app in Microsoft Entra ID. The group then deployed VMs for crypto mining.

Organizations targeted in this way by Storm-1283 had racked up compute fees ranging from $10,000 to $1.5 million, according to Redmond.

Microsoft’s researchers also observed business email compromise and phishing attacks, highlighting some key subject lines to look out for:

  • shared “ contracts” with you.
  • shared “” with you.
  • OneDrive: You have received a new document today
  • Mailbox password expiry
  • Mailbox password expiry
  • You have Encrypted message
  • Encrypted message received

Redmond’s boffins have also drawn up plans to help organizations reduce the likelihood of becoming victims, including implementing security practices such as multi-factor authentication (MFA), enabling conditional access policies, and enabling continuous access evaluation (CAE).

IT workers can refer to Microsoft’s blog post for a full list of mitigation steps and a detailed analysis of the attacks.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.