Microsoft OAuth Phishing Attack Abuses Trusted Login to Compromise 365 Accounts

Attackers have found a way to make phishing nearly undetectable: they’ve stopped faking Microsoft’s login page and started using the real one.

Between June 25 and the second week of July 2026, Check Point Email Researchers tracked more than 200 phishing emails targeting users across roughly 120 organizations worldwide. The campaign didn’t rely on a spoofed domain or a cloned sign-in screen.

Instead, it weaponized Microsoft’s own OAuth authorization flow, turning a trusted authentication system into the delivery mechanism for account compromise.

Microsoft OAuth Phishing Attack Abuses Trusted

The emails impersonated Microsoft Planner task-assignment alerts, sent under the display name “There’s New Activity On Team.” The subject line, “HR@[company].com Sent 3 Messages Via Teams Chat,” combined with urgency cues like a “4 Overdue Employee Tasks” counter, was designed to trigger a fast click rather than careful scrutiny.

A particularly effective trick: the visible sender address matched the recipient’s own organization, so the email appeared to come from inside the company. Every link and call-to-action button routed through the same redirect, regardless of what the button claimed to do.

What made this campaign dangerous wasn’t clever spoofing; it was the absence of it. Clicking the link opened an actual login.microsoftonline.com OAuth authorize URL, not a lookalike domain.

The user would sign in normally, then reach a permissions prompt asking them to “Approve permissions” or “Accept on behalf of your organization.” Once approved, Microsoft redirected the browser to the redirect_uri specified in the original request, in this case, an AWS API Gateway endpoint controlled by the attacker.

The authorization code delivered to that endpoint gave the attacker whatever access the victim had just granted. This technique, tracked within the MITRE ATT&CK framework, isn’t new. What’s changed in 2026 is scale: it has shifted from a manual, targeted attack into a rentable service accessible to far less sophisticated threat actors.

The blast radius depends entirely on the permissions scope, but attacker-controlled apps in this campaign could potentially reach:

Email (read, search, and send from the victim’s own mailbox, a springboard for BEC fraud)
Files the user can open, download, or share
Teams chats and channel conversations
SharePoint sites and document libraries
OneDrive personal storage
Calendar data useful for reconnaissance and timing future lures

Nearly all affected organizations, 98.3%, were in North America, with small pockets in Asia and LATAM. By sector, Industrial/Manufacturing led with 19.3% of emails across 15 organizations, followed by Legal/Professional Services (13.9%, 21 organizations), Nonprofit/Associations (10.9%, 16 organizations), Government/Public Sector (8.9%, 9 organizations), and Healthcare (6.9%, 11 organizations).

The remainder fell into other, less-concentrated sectors. Every screen the victim sees is genuinely issued by Microsoft. The only forged element is the intent behind the app’s request for access, something no domain-reputation check or SSL warning will ever catch.

Hover over links before clicking; be suspicious if multiple buttons lead to the same URL
Confirm sender name, address, and domain are consistent; don’t trust internal-looking senders by default
Access Teams or other apps directly rather than through email links
Report suspicious messages immediately so security teams can revoke malicious app consent and contain affected accounts

The campaign is no longer active, but it’s a clear signal that consent phishing is becoming a mainstream tactic rather than an edge case.