Microsoft says criminals are misusing OAuth apps to launch scam attacks

Crypto mining
Kryptovaluuttojen louhinta on tehokkainta oikeilla komponenteilla. (Image credit: Shutterstock / Yevhen Vitte)

Microsoft says its Threat Intelligence team has been observing financially motivated attacks and scams using OAuth apps as automation tools.

In a new post, the team explained how threat actors have compromised user accounts to create, modify, and grant high privileges to OAuth apps to hide malicious activity.

Fortunately, the scale of the attacks has been measured by means of account protection – attackers have been targeting user accounts without strong authentication mechanisms – which at least gives users and admins some hope to apply further protection against the scams.

Is your account securely protected?

Microsoft said that threat actors mostly launched their attacks via phishing or password spraying methods. They then went on to misuse OAuth apps with high privilege permissions for a variety of reasons.

A group tracked as Storm-1283 (the Storm prefix suggests that this is currently a low-scale group that’s in developed rather than a long-standing threat actor) was caught signing in via a VPN and creating a new single-tenant OAuth app in Microsoft Entra ID. The group then deployed VMs for crypto mining.

Organizations targeted in this way by Storm-1283 had racked up compute fees ranging from $10,000 to $1.5 million, according to Redmond.

Microsoft’s researchers also observed business email compromise and phishing attacks, highlighting some key subject lines to look out for:

  • <Username> shared “<Username> contracts” with you.
  • <Username> shared “<User domain>” with you.
  • OneDrive: You have received a new document today
  • <Username> Mailbox password expiry
  • Mailbox password expiry
  • <Username> You have Encrypted message
  • Encrypted message received

Redmond’s boffins have also drawn up plans to help organizations reduce the likelihood of becoming victims, including implementing security practices such as multi-factor authentication (MFA), enabling conditional access policies, and enabling continuous access evaluation (CAE).

IT workers can refer to Microsoft’s blog post for a full list of mitigation steps and a detailed analysis of the attacks.

More from TechRadar Pro

Craig Hale

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!