Multiple miscreants are misusing OAuth to automate financially motivated cyber crimes - such as business email compromise, phishing, large-scale spamming campaigns - and deploying virtual machines to illicitly mine for cryptocurrencies, according to Microsoft.
OAuth, short for Open Authorization, is an open standard for token-based access delegation, allowing applications to access resources and data hosted by other web apps.
Microsoft's identity platform uses OAuth 2.0 for handling authorization.
Like almost any software, it can be abused for nefarious purposes.
OAuth is an especially appealing target for criminals in cases where compromised accounts don't have strong authentication in place, and user permissions allow them to create or modify OAuth applications.
Microsoft, in a threat intel report, details one cyber crime crew it tracks as Storm-1283 that used a compromised account to create an OAuth application and deploy VMs for crypto mining, while also racking up between $10,000 and $1.5 million in Azure compute fees.
The crew also took advantage of other OAuth applications that the compromised user could access, and added new credentials to those apps to expand its mining capabilities.
The crims started with a small set of VMs before returning to deploy more.
A different cybercrime gang, Storm-1286, abused OAuth applications for a massive spamming campaign after compromising email accounts with password spraying.
Most of the compromised accounts did not have multi-factor authentication enabled.
The criminals used compromised accounts to create more new OAuth applications using Azure PowerShell or a Swagger Codegen-based client.
The attackers used the compromised email accounts to grant permission to the new apps.
The emails contained a malicious URL leading to an attacker-controlled proxy service that sits between the victim and the legitimate Microsoft sign-in page.
This type of man-in-the-middle or adversary-in-the-middle attack allows the crooks to steal the token from the user's session cookie.
These stolen tokens can then be abused for session cookie replay activity.
Microsoft also published a set of incident response playbooks for App consent grant investigation and compromised and malicious applications investigation to help security teams respond more quicky to these types of threats.
This Cyber News was published on go.theregister.com. Publication date: Thu, 14 Dec 2023 12:13:05 +0000