Threat reportPhishingTL-2026-1778
OAuth Consent Phishing Abuses Microsoft's Legitimate Login System to Harvest Microsoft 365 Tokens
OAuth Consent Phishing Abuses Microsoft's Legitimate Login (TL-2026-1778) is a high-severity phishing campaign, first published 2026-07-30. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID OAuth 2.0 delegated authorization, maps to 17 MITRE ATT&CK techniques (T1041, T1071.001, T1098.001), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1778
- Threat ID
- TL-2026-1778
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, legal, health, nonprofit, government administration
- Target regions
- North America, Asia, Latin America
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in OAuth Consent Phishing Abuses Microsoft's Legitimate Login
Malware and tooling: ConsentFix v3, EvilTokens, Kali365
How OAuth Consent Phishing Abuses Microsoft's Legitimate Login works
Check Point Research identified a phishing campaign (June 25 - mid-July 2026) that impersonated Microsoft Planner/Teams task notifications and routed roughly 200 emails at ~120 organizations through Microsoft's genuine login.microsoftonline.com OAuth authorization flow. Victims who approved the malicious application's permission request were redirected to an attacker-controlled AWS API Gateway endpoint that harvested authorization tokens, granting access to Microsoft 365 email, files, Teams chats, SharePoint, OneDrive, and calendar data without ever presenting a fake login page.
Between 25 June and the second week of July 2026, Check Point Research tracked a phishing campaign that abused OAuth's delegated-authorization model rather than credential harvesting. Emails were sent from a spoofed sender using the recipient's own organizational domain, with the display name "There's New Activity On Teams" and a subject line pattern of "HR@[company].com Sent 3 Messages Via Teams Chat." The email body impersonated a Microsoft Planner task-assignment notification referencing a "Payroll, Compensation + Benefits Update" with a "4 Overdue Employee Tasks" urgency counter.
Clicking the embedded link took the victim to a completely legitimate login.microsoftonline.com OAuth 2.0 /authorize endpoint. The victim authenticated normally (including any MFA challenge) against real Microsoft infrastructure, then was shown a standard consent screen requesting permission for a third-party-registered application. Because every visible screen in the chain is authentic Microsoft UI, the flow evades detection controls built around fake login pages or spoofed domains — Check Point summarized the shift as "attackers have stopped forging Microsoft's front door and started walking through it."
Upon approval, Microsoft's OAuth flow redirected the victim's browser to the `redirect_uri` registered by the attacker's application: an AWS API Gateway endpoint under attacker control (not a Microsoft-owned domain). That endpoint received the authorization code/token, which the attackers exchanged for access and refresh tokens scoped to whatever permissions the victim approved — up to and including read/write mail access, file access (OneDrive/SharePoint), Teams chat access, and calendar data. No credentials were phished and no malware was delivered; the attacker's only asset is the malicious OAuth application registration and its AWS-hosted token-collection endpoint.
The campaign spanned roughly 120 organizations, concentrated in Industrial/Manufacturing (~19.3% of emails — 39 emails against 15 organizations), Legal/Professional Services (~13.9% — 28 emails against 21 organizations), Nonprofit/Associations (~10.9% — 22 emails against 16 organizations), Government/Public Sector (~8.9% — 18 emails against 9 organizations), and Healthcare (~6.9% — 14 emails against 11 organizations), overwhelmingly in North America (~98.3%), with minor Asia and Latin America exposure (~0.9% each). Check Point states the specific campaign is no longer active, but frames the underlying illicit-consent-grant technique as having evolved "from a targeted, manually built attack into a service that virtually anyone can rent" by 2026 — consistent with the broader 2026 proliferation of OAuth-consent-phishing-as-a-service platforms such as EvilTokens (340+ M365 orgs compromised within 5 weeks of its February 2026 launch) and Kali365 (FBI IC3 PSA260521, April 2026), and automated toolkits like ConsentFix v3 targeting Azure/Entra ID with MFA and Conditional Access bypass. Because the attacker holds a legitimately-issued OAuth token rather than a replayed credential, MFA provides no protection: the victim personally completes the MFA challenge and then clicks Accept on the attacker's behalf. Refresh tokens obtained this way commonly remain valid for weeks (up to ~90 days depending on tenant policy) and survive password resets, giving attackers standing, low-noise access that resembles normal user activity in audit logs. Check Point specifically flags the compromised mailbox access as "a common springboard for follow-on BEC fraud from a trusted internal address": because the token grants send-as capability from a real, previously-trusted account, attackers can pivot from silent token theft into internal spearphishing and invoice/wire-fraud schemes that are far harder for recipients or mail-flow rules to distinguish from legitimate internal correspondence. Check Point's own detection guidance for end users centers on three checks that generalize beyond this specific lure: verify a link's true destination before clicking, treat it as suspicious when multiple buttons/links in one email all resolve to the same URL, and confirm the sender's display name, address, and domain are mutually consistent — since display names remain trivially spoofable even when the underlying address looks internal.
MITRE ATT&CK techniques used in TL-2026-1778
Exfiltration
T1041 Exfiltration Over C2 Channel
Command and Control
Persistence
T1098.001 Additional Cloud Credentials
Privilege Escalation
T1098.001 Additional Cloud Credentials
Collection
T1114.002 Remote Email Collection; T1213 Data from Information Repositories; T1213.002 Sharepoint; T1530 Data from Cloud Storage
Execution
Credential Access
T1528 Steal Application Access Token
Lateral Movement
T1534 Internal Spearphishing; T1550.001 Application Access Token
lateral-movement
T1550.001 Application Access Token
Initial Access
Resource Development
T1583.006 Web Services; T1583.007 Serverless
Reconnaissance
Impact
stealth
Affected products and versions in OAuth Consent Phishing Abuses Microsoft's Legitimate Login
- Microsoft — Microsoft 365 / Entra ID OAuth 2.0 delegated authorization (login.microsoftonline.com)
Vulnerable versions: All Microsoft 365 tenants with default end-user application-consent settings enabled
Fixed in: Tenants with admin-consent workflow enforced and consent restricted to verified publishers
Remediation for OAuth Consent Phishing Abuses Microsoft's Legitimate Login
Patches
- Not applicable — this is abuse of legitimate Microsoft OAuth 2.0 / Entra ID delegated-authorization functionality, not a software vulnerability; no vendor patch exists
Immediate actions
- Audit third-party OAuth application grants tenant-wide and revoke any with Mail.Read/Mail.ReadWrite, Mail.Send, Files.Read.All, or offline_access scopes that are unrecognized or unverified
- Search mail flow and message-trace logs for internally-spoofed senders (From = recipient's own domain) with display names referencing 'New Activity On Teams' or Planner task-overdue/payroll notifications
- Force re-authentication and revoke refresh tokens for any user who approved an application consent prompt between 2026-06-25 and 2026-07-13
- Review Entra ID sign-in and app-consent audit logs for OAuth authorization redirects to non-Microsoft redirect_uri domains, including *.execute-api.*.amazonaws.com endpoints
Workarounds
- Disable self-service application registration for standard users in Entra ID
- Add mail-flow/transport rules to flag or quarantine inbound mail impersonating internal Teams/Planner notification patterns, especially HR/Payroll-themed urgency lures
- User awareness guidance: review the requested permissions and publisher identity on any OAuth consent screen before clicking Accept, particularly for unsolicited HR/Payroll/Teams-activity prompts
- Train users to hover over links to verify true destination before clicking, and to treat an email as suspicious when multiple distinct buttons/links all resolve to the same underlying URL (per Check Point's specific detection guidance)
- Instruct users to verify sender display name, address, and domain are mutually consistent, and to distrust apparently-internal senders by default since display names remain spoofable even when the address looks legitimate
- Monitor for and restrict send-as/send-on-behalf-of activity from newly-token-authorized mailboxes to catch follow-on BEC/internal-spearphishing pivots from a compromised trusted account
Longer-term hardening
- Enforce an admin-consent workflow for all third-party OAuth applications requesting delegated Microsoft Graph permissions; disable end-user self-consent for high-privilege scopes
- Restrict user consent in Entra ID to verified publishers only, and block consent to newly-registered or unverified applications by default
- Deploy continuous OAuth/SaaS application inventory and grant-age monitoring (flag grants unreviewed after 30+ days, flag identities authorized across 3+ SaaS apps)
- Configure Conditional Access policies that evaluate risk on consent events themselves, not only on interactive authentication events
- Establish a token-level revocation playbook (revoke refresh tokens, invalidate sessions, rotate app secrets) independent of password-reset procedures, since refresh tokens survive password resets
Timeline of OAuth Consent Phishing Abuses Microsoft's Legitimate Login
- Rescana documents ConsentFix v3, an automated OAuth-abuse toolkit targeting Microsoft Azure/Entra ID that bypasses MFA and Conditional Access, illustrating the broader consent-phishing tooling ecosystem this campaign's technique belongs to (approximate date — source gives no specific day).
- EvilTokens, a phishing-as-a-service platform built around OAuth consent phishing, goes live; compromises more than 340 Microsoft 365 organizations across five countries within five weeks (approximate date — source gives month only).
- Kali365, an FBI-tracked phishing-as-a-service kit that hijacks Microsoft 365 access tokens via device-code phishing, is first observed (approximate date — source gives month only).
- The Hacker News publishes "The New Phishing Click: How OAuth Consent Bypasses MFA," documenting the broader trend of OAuth-consent phishing defeating MFA that presaged this campaign's disclosure.
- FBI Internet Crime Complaint Center (IC3) publishes PSA260521 warning organizations about the Kali365 phishing-as-a-service kit targeting Microsoft 365 access tokens.
- Check Point Research begins tracking a phishing campaign impersonating Microsoft Planner/Teams task notifications that redirects victims through the legitimate login.microsoftonline.com OAuth flow to an attacker-controlled AWS API Gateway endpoint.
- Campaign activity winds down (source states 'through the second week of July 2026'; exact end date approximate). Over 200 phishing emails had targeted roughly 120 organizations.
- Check Point Research publishes a technical writeup, 'Attackers Are Turning Microsoft's Trusted Login System Into Their Latest Phishing Weapon,' detailing the campaign's OAuth-abuse mechanics.
- Help Net Security publishes coverage of the Check Point findings, noting the underlying technique is now offered 'as a service that virtually anyone can rent' despite this specific campaign having ended; TL-2026-1778 opened.
Sources cited for OAuth Consent Phishing Abuses Microsoft's Legitimate Login
- Attackers are using Microsoft's legitimate login system to camouflage phishing attacks
- Attackers Are Turning Microsoft's Trusted Login System Into Their Latest Phishing Weapon
- Teams-Themed Phishing Campaign Abused Legitimate Microsoft Login Pages
- Attackers Weaponize Microsoft's Trusted Login System for Phishing
- The New Phishing Click: How OAuth Consent Bypasses MFA
- The Illicit Consent Grant Part 1: Understanding Modern OAuth Consent Phishing
- Use Alternate Authentication Material: Application Access Token, T1550.001
- Steal Application Access Token, T1528
- Phishing: Spearphishing Link, T1566.002
- Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens
- ConsentFix v3: Automated OAuth Abuse Targets Microsoft Azure and Entra ID, Bypassing MFA and Conditional Access
Detection coverage for TL-2026-1778
As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1778 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.