Attackers are compromising high-privilege Microsoft accounts and abusing OAuth applications to launch a variety of financially-motivated attacks.
OAuth is an open standard authentication protocol that uses tokens to grant applications access to server resources without having to use login credentials.
Microsoft Threat Intelligence has observed a number of attacks that started with attackers compromising poorly secured accounts that have permissions to create, modify, and grant high privileges to OAuth applications.
They can then misuse these applications to hide malicious activity and maintain access to the apps even if they lose access to the initially compromised account, the analysts noted.
In one of the detected attacks, the attackers generated an OAuth application to deploy virtual machines used for cryptocurrency mining.
OAuth application for cryptocurrency mining attack chain.
In another attack, after having created OAuth applications, the attackers started sending out phishing emails by leveraging an adversary-in-the-middle phishing kit.
This allowed them to steal the user's session cookie token and perform session cookie replay activity.
In some instances, the attackers used the compromised accounts to find emails mentioning payments or invoices, so they can insert themselves in the email conversation and redirect payments to their own banking accounts.
Other instances saw the attackers creating multitenant OAuth applications to gain persistence, adding new credentials, creating inbox rules to move emails to the junk folder and mark them as read, and reading emails or sending phishing emails via Microsoft Graph API. Attack chain for OAuth application misuse for phishing.
While in these attacks OAuth apps are leveraged to gain persistence to compromised accounts and to extend the attacks, attackers have also been known to use seemingly verified third-party OAuth apps to gain access to O365 email accounts.
Microsoft's threat analysts have shared detections and hunting guidance to help defenders and threat hunters check for suspicious activity related to these latest attacks.
They also listed mitigation steps organizations can take to protect themselves, which include: protecting accounts with multi-factor authentication, enabling conditional access policies, enabling Microsoft Defender automatic attack disruption, auditing apps and permissions, and more.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Wed, 13 Dec 2023 14:13:05 +0000