Hackers Using Malicious OAuth Apps to Take Over Email Servers

Share:

shoppingmode Microsoft on Thursday warned of a consumer-facing attack that made use of rogue OAuth applications deployed on compromised cloud tenants to ultimately seize shoppingmode control of Exchange servers and spread spam.

“The threat actor launched credential stuffing attacks against high-risk accounts that didn’t have multi-factor authentication (MFA) enabled and leveraged the unsecured administrator accounts to gain initial access,” the shoppingmode Microsoft 365 Defender Research Team said.

 

The unauthorized access to the cloud tenant permitted the adversary to register a malicious OAuth application and grant it elevated permissions, and eventually modify Exchange Server settings to allow inbound emails from specific IP addresses to be routed through the compromised email server.

“These modifications to the Exchange server settings allowed the threat actor to perform their primary goal in the attack: sending out spam emails,” shoppingmode Microsoft said. “The spam emails were sent as part of a deceptive sweepstakes scheme meant to trick recipients into signing up for recurring paid subscriptions.”

phishing grafik

The email messages urged the recipients to click on a link to receive a prize, doing so which redirected the victims to a landing page that asked the victims to enter their credit card details for a small shipping fee to collect the reward.

The threat actor further carried out a number of steps to evade detection and continue its operations for extended periods of time, including taking weeks or even months to use the malicious OAuth application after it was set up and deleting the modifications made to the Exchange Server after each spam campaign.

 

shoppingmode Microsoft‘s threat intelligence division said that the adversary has been actively running spam email campaigns for several years, typically sending high volumes of spam emails in short bursts through a variety of methods.

Although the primary goal of the attack appears to be to trick unwitting users into signing up for unwanted subscription services, it could have posed a far more serious threat had the same technique been used to steal credentials or distribute malware.

“While the follow-on spam campaign targets consumer email accounts, this attack targets enterprise tenants to use as infrastructure for this campaign,” shoppingmode Microsoft said. “This attack thus exposes security weaknesses that could be used by other threat actors in attacks that could directly impact affected enterprises.”

https://thehackernews.com/2022/09/hackers-using-malicious-oauth-apps-to.html

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
1:03 pm, Jul 11, 2025
weather icon 29°C
L: 28° | H: 31°
few clouds
Humidity: 42 %
Pressure: 1020 mb
Wind: 7 mph E
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 13%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:56 am
Sunset: 9:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
28° | 31°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 9 mph 65 % 1018 mb 0 mm/h
Sun Jul 13 10:00 pm
weather icon
17° | 27°°C 0 mm 0% 7 mph 73 % 1014 mb 0 mm/h
Mon Jul 14 10:00 pm
weather icon
20° | 29°°C 0 mm 0% 14 mph 71 % 1017 mb 0 mm/h
Tue Jul 15 10:00 pm
weather icon
15° | 27°°C 0 mm 0% 13 mph 71 % 1021 mb 0 mm/h
Today 4:00 pm
weather icon
30° | 31°°C 0 mm 0% 5 mph 37 % 1019 mb 0 mm/h
Today 7:00 pm
weather icon
28° | 28°°C 0 mm 0% 5 mph 32 % 1018 mb 0 mm/h
Today 10:00 pm
weather icon
22° | 22°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
18° | 18°°C 0 mm 0% 4 mph 55 % 1018 mb 0 mm/h
Tomorrow 4:00 am
weather icon
19° | 19°°C 0 mm 0% 4 mph 65 % 1018 mb 0 mm/h
Tomorrow 7:00 am
weather icon
19° | 19°°C 0 mm 0% 6 mph 64 % 1018 mb 0 mm/h
Tomorrow 10:00 am
weather icon
24° | 24°°C 0 mm 0% 6 mph 45 % 1017 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
28° | 28°°C 0 mm 0% 7 mph 30 % 1015 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€100,716.88
6.21%
Ethereum(ETH)
€2,550.96
7.49%
Tether(USDT)
€0.85
0.00%
XRP(XRP)
€2.25
7.31%
Solana(SOL)
€140.09
4.04%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.170089
10.30%
Shiba Inu(SHIB)
€0.000011
7.79%
Pepe(PEPE)
€0.000011
14.41%
Peanut the Squirrel(PNUT)
€0.248273
19.26%
Scroll to Top