Threat Actors Impersonate Businesses Using Fake Microsoft OAuth Apps for Credential Theft

Introduction to the Threat

In a rapidly evolving landscape of cybersecurity threats, researchers have identified an alarming trend where cybercriminals are mimicking reputable enterprises through counterfeit Microsoft OAuth applications. This tactic is primarily aimed at harvesting user credentials to facilitate account takeover attacks, emphasizing the need for heightened vigilance in enterprise security practices.

Impersonation Tactics and Targets

According to a recent report by Proofpoint, these fraudulent Microsoft 365 applications masquerade as various well-known companies, including RingCentral, SharePoint, Adobe, and DocuSign. This ongoing campaign first emerged in early 2025 and employs deceptive tactics designed to lure unsuspecting users into divulging sensitive information.

The Mechanism of Attack

The attack typically initiates via phishing emails dispatched from compromised accounts. These emails are crafted to appear harmless, often using plausible pretenses such as requests for quotes or business contracts. When recipients click on the provided links, they are redirected to a Microsoft OAuth page for an application named "iLSMART." This page requests users to grant permissions to access their basic profile and data.

What sets this attack apart is the impersonation of ILSMart, a legitimate marketplace serving the aviation, marine, and defense industries. While the permissions solicited may seem benign, they serve as a preliminary step for attackers to pave the way for more malicious intentions.

The Phishing Process

Whether the targeted user accepts or denies the requested permissions, they are redirected through a CAPTCHA verification process, ultimately landing on a fraudulent Microsoft account authentication page. This part of the attack leverages adversary-in-the-middle (AiTM) phishing techniques, utilizing platforms like Tycoon, which operate as Phishing-as-a-Service (PhaaS). Here, attackers gain access to both user credentials and multi-factor authentication (MFA) codes, escalating the severity of the breach.

Recent Campaigns and Broader Context

In a noteworthy development from last month, Proofpoint revealed another phishing campaign impersonating Adobe. This example used Twilio SendGrid to distribute emails designed with similar tactics—seeking user authorization or triggering flows that lead victims to phishing pages. The scale of these operations is significant; 2025 has already seen attempts to compromise nearly 3,000 Microsoft 365 accounts across more than 900 different environments.

Increasing Complexity of Cyber Attacks

The cyber threat landscape is continuously evolving, with criminals innovating their attack chains to evade detection and secure unauthorized access to organizations on a global scale. Experts predict that attacks targeting user identity will become more common, with AiTM credential phishing as a growing trend within the criminal ecosystem.

Microsoft’s Response to Security Threats

In response to these escalating threats, Microsoft has announced plans to implement updates aimed at strengthening security protocols. By August 2025, the company intends to block legacy authentication protocols and require administrative consent for third-party application access. This strategy is anticipated to restrict the capabilities of threat actors employing these impersonation techniques.

Additional measures include the disabling of external workbook links to blocked file types from 2025 to 2026, a move aimed at bolstering security and preventing malware exploitation.

Malware Deployment and Ongoing Campaigns

As cybersecurity researchers dig deeper, they have also identified spear-phishing campaigns utilizing fake payment receipts to deliver .NET malware like the VIP Keylogger. This malware can capture sensitive data from compromised systems, highlighting the multi-faceted nature of recent threats.

Moreover, separate spam campaigns have been detected that embed installation links for remote desktop software within seemingly legitimate PDF files. These documents are often disguised as invoices or contracts, enhancing their credibility and enticing targeted individuals to click.

Conclusion

The cybersecurity landscape is marked by increasingly sophisticated tactics employed by threat actors. As businesses navigate these challenges, it is essential for organizations to prioritize employee training and adopt robust security measures to safeguard against such attempts at credential harvesting and account takeover. By staying informed and vigilant, companies can better protect themselves from the ever-evolving techniques of cybercriminals.