Attackers Exploit Microsoft OAuth Login to Deliver Phishing Campaigns Across 120 Organizations
What Happened — Between June 25 and early July 2026, Check Point observed more than 200 phishing emails targeting roughly 120 companies worldwide. The messages masquerade as Microsoft Planner task‑assignment notifications and, after a click, redirect victims to a genuine login.microsoftonline.com OAuth consent screen. When users approve the request, an attacker‑controlled app receives a token that can be used to access the victim’s Microsoft 365 data.
Why It Matters for Compliance & Audit Readiness
- The technique sidesteps traditional URL‑based phishing filters, highlighting the need for continuous security awareness training and documented phishing‑simulation programs that satisfy SOC 2 CC6.2 (Security Awareness).
- OAuth consent abuse creates a third‑party access risk that must be captured in your vendor‑management and access‑control evidence, a core requirement of SOC 2 CC5.1 (Logical Access).
- Demonstrating that you regularly test and remediate such social‑engineering vectors provides audit‑ready evidence of a mature risk‑management process.
Who Is Affected — Enterprises across finance, healthcare, technology, and other sectors that rely on Microsoft 365 for collaboration and data storage.
Recommended Actions
- Update your security awareness curriculum to include OAuth‑based phishing scenarios and conduct regular simulated attacks.
- Enforce least‑privilege consent policies in Azure AD; require admin approval for any third‑party app requesting high‑impact permissions.
- Enable MFA and Conditional Access policies that flag anomalous consent grants.
- Log and review OAuth consent events in Azure AD sign‑in logs; retain evidence for audit purposes.
Source: Help Net Security
Technical Notes
- Attack vector: Phishing → OAuth consent abuse → token theft.
- No CVE; technique is cataloged in MITRE ATT&CK as “Phishing for Information” (T1566.002) and “Abuse of OAuth” (T1110.003).
- Compromised data can include email, Teams chats, SharePoint files, OneDrive, and calendar entries.
Source: Help Net Security