⚠️ Attackers Breach Microsoft 365 Using Fake OAuth Apps — Here’s What You Need to Know
Cybercriminals have evolved once again. A newly uncovered attack wave is leveraging fake Microsoft OAuth apps — backed by the Tycoon phishing toolkit — to compromise Microsoft 365 accounts across the globe. Over 3,000 user accounts and 900+ tenants have been targeted so far in 2025 alone.
Fake Apps Masquerading as Trusted Brands
According to Proofpoint, attackers are creating OAuth apps that impersonate real companies, such as:
- RingCentral
- SharePoint
- Adobe
- DocuSign
- And more…
In one prominent case, victims were redirected to an app called “iLSMART”, posing as a legitimate aviation parts marketplace. Users are tricked into granting access permissions to the app, believing it's part of a quote request or business contract flow.
Phishing Powered by Tycoon & ODx Kits
The attack begins with phishing emails sent from compromised accounts, asking the recipient to review documents. Clicking the links leads to:
- A legitimate-looking Microsoft OAuth page asking for permissions.
- Regardless of the user's choice, they’re redirected to:
- A fake CAPTCHA
- A phishing page mimicking Microsoft login
- This uses adversary-in-the-middle (AiTM) techniques to steal credentials and MFA tokens.
This is all powered by Tycoon Phishing-as-a-Service (PhaaS) — an increasingly popular toolkit among cybercriminals.
Escalating Threats in 2025
This campaign is just one of many. In another recent case, fake Adobe apps were distributed using Twilio SendGrid. Across the board, attackers are chaining together:
- OAuth abuse
- AiTM phishing
- MFA interception
- RMM tools for remote control
RMM tools such as FleetDeck, Action1, SuperOps, and Atera have been hidden inside PDF files disguised as invoices or contracts. These campaigns have heavily targeted Western Europe since late 2024.
Microsoft Responds with Security Enhancements
To fight back, Microsoft is rolling out critical security updates by August 2025:
- Blocking legacy authentication by default
- Requiring admin consent for third-party apps
- Disabling external workbook links to risky file types
These changes aim to reduce OAuth abuse and limit attackers’ ability to maintain access.
What You Can Do
- Audit OAuth apps in your M365 environment regularly.
- Block legacy authentication protocols.
- Educate staff on modern phishing tactics (AiTM, OAuth abuse).
- Consider Conditional Access and Identity Protection policies.
Need help reviewing or improving your Microsoft 365 security posture?
👉 [Contact Alcaeus] – Experts in identity & access defense.
