Check Point uncovers OAuth phishing campaign exploiting genuine Microsoft logins, targeting 120+ orgs
This digest was compiled by AI from multiple sources — links to the originals are below.
Check Point's email research team disclosed a phishing campaign that ran from late June into July 2026, abusing real Microsoft login pages to compromise accounts across over 120 organizations worldwide. The attackers sent fake Microsoft Teams notifications directing victims to a legitimate OAuth authorization URL, then tricked them into approving permissions for a malicious application, granting access to email, files, and messaging platforms without stealing passwords or defeating multi-factor authentication. The tactic eliminates the need for look-alike domains or credential harvesting, underscoring a shift in attacker methods.
The Phishing Lure
The emails appeared as Microsoft Planner task-assignment notifications. The sender name read 'There's New Activity On Team,' with a subject line claiming HR sent three Teams messages about payroll and benefits. A counter displayed four overdue employee tasks. Every link in the email routed through the same redirect, and the visible sender address belonged to the recipient's own domain. Over 200 such emails were sent to targets in roughly 120 organizations globally.
OAuth Consent Exploitation
Instead of harvesting credentials, the campaign exploited the OAuth authorization flow. Victims clicking the link landed on a genuine login.microsoftonline.com page, not a fake domain. After signing in, they saw a permissions prompt requesting access to mail, files, Teams, SharePoint, OneDrive, and calendars. Approving the prompt sent an authorization code to an attacker-controlled AWS API Gateway endpoint, where it was exchanged for an access token. This bypassed multi-factor authentication entirely, as the token granted persistent access without a password.
Defense and Commoditization
Check Point noted that the technique has been commoditized in 2026 into a rentable service, lowering the barrier for attackers. The practical defense is restricting app consent policies rather than training users to spot fake pages. Organizations should enforce admin approval for third-party app permissions and monitor OAuth activity. Check Point's research underscores that authentication security must extend beyond passwords and MFA to authorization controls.
What's Next
Check Point warns that the commoditization of this technique could lead to wider adoption, and security teams should urgently review consent policies. It remains unclear how many organizations may already be compromised by similar app-based attacks.
1 source
Check Point uncovers OAuth phishing campaign exploiting genuine Microsoft logins, targeting 120+ orgs
