Threat advisory · 28 August 2026
OAuth consent phishing against Microsoft 365 tenants
Attackers are bypassing multi-factor authentication by tricking users into granting a malicious application access to mail and files.
Rather than stealing a password, the attacker asks the user to approve an application. Consent grants long-lived access to mail, files and directory data, and it survives a password reset.
Restrict user consent to verified publishers and low-impact permissions, require admin approval for everything else, and review existing enterprise applications for unexpected grants.
Where a grant has already been given, revoke the application, revoke refresh tokens for the affected accounts and review mailbox rules and recent file access.
What we are doing
Consent monitoring
Consent and application-permission events are monitored as part of M365 coverage, with documented investigation on every case.
Tenant configuration hardening for consent policies is part of Continuous Improvements.