Wiz Details Detection of Malicious OAuth Apps Across 2019 and 2025 Campaigns
Summary
Wiz describes a pipeline for finding malicious Microsoft Entra OAuth apps and reports 19 apps in a 2025 campaign, plus seven apps dating to 2019 that it says appeared across more than 50 organizations.
Key points
- Wiz says a 2025 campaign used 19 OAuth apps impersonating brands including Adobe, DocuSign and OneDrive, targeting multiple organizations; Proofpoint independently reported the campaign.
- The apps used phishing and deceptive consent prompts to obtain delegated access to users’ email and files, which Wiz says could persist until the OAuth grant or service principal was removed.
- Wiz’s pipeline combines baseline prevalence, app names, publisher and ownership details, permissions, homepage and reply URLs, and AI-assisted contextual evaluation to prioritize suspicious apps.
- The researchers say the pipeline also found seven malicious apps dating to 2019, including homoglyph impersonations of Microsoft services; they report these apps were used across more than 50 organizations.
- Wiz describes a shift from Microsoft-focused homoglyph spoofing to more contextual impersonation of third-party productivity brands and reuse of redirect infrastructure.
- Recommended defenses include restricting consent for unverified publishers, auditing OAuth grants, alerting on newly observed apps, and reviewing permissions and reply URLs.
Article Details
- Attack Vectors
- Phishing emails lure users to a real Microsoft sign-in page, where they are prompted to grant consent to attacker-controlled OAuth applications impersonating trusted services.
- After consent, OAuth access tokens are sent to attacker-selected redirect URLs. Delegated permissions can then enable access to users' email and files and persistent access through the service principal.
- Malicious applications impersonate brands using familiar names and logos, including Cyrillic homoglyphs, and use suspicious or unrelated reply URLs and low-prevalence application profiles.
- Defensive Notes
- Restrict non-admin users from granting consent to applications from unverified publishers.
- Regularly inventory and audit OAuth grants, prioritizing applications consented to by only one or two users.
- Alert on applications first observed in the tenant, especially when their reply URLs do not match known enterprise services.
- Assess application names, publisher verification, ownership and associated domains, requested permissions, tenant prevalence, homepage URLs, and reply URLs together.
- Monitor high-risk permissions such as Mail.Read and Files.ReadWrite.All, particularly when requested by an external, unverified publisher.
- Baseline reply URLs and scan them for suspicious patterns or known malicious hosting.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | officemtr[.]com | Host used in a 2019 malicious OAuth application's reply URL, shown in the article's campaign comparison. |
| DOMAIN | sharepoint[.]microzoftonline[.]com | Reply URL host identified in the article as part of a 2019 homoglyph campaign impersonating Microsoft services. |
| URL | hxxps[:]//adobe[.]mareanebulosasao[.]it[.]com/WOWFM | Reply URL listed for a 2025 malicious OAuth application impersonating Adobe. |
| URL | hxxps[:]//embeds[.]beehiiv[.]com/2066d619-1342-40ba-893d-6d0e6eee70d5 | Reply URL listed for a 2025 malicious OAuth application impersonating DocuSign. |
| URL | hxxps[:]//emircoms[.]com/auto | Reply URL listed for a 2025 malicious OAuth application impersonating Adobe. |
| URL | hxxps[:]//emircoms[.]com/auto/apc[.]html | Reply URL reused by 2025 malicious OAuth applications named Teams Task Planner and DocuSign-2025. |
| URL | hxxps[:]//fancy-bush-61e9sydgsyi29s[.]jennifer-may[.]workers[.]dev/ | Reply URL listed for a 2025 malicious OAuth application named Adobe Drive X. |
| URL | hxxps[:]//jaimereintsteamworkspace[.]myclickfunnels[.]com/securedfile | Reply URL listed for a 2025 malicious OAuth application impersonating Adobe. |
| URL | hxxps[:]//kimharrysteamworkspace[.]myclickfunnels[.]com/securedocument | Reply URL listed for a 2025 malicious OAuth application impersonating DocuSign. |
| URL | hxxps[:]//kimharrysteamworkspace[.]myclickfunnels[.]com/sharedfil | Reply URL listed for a 2025 malicious OAuth application impersonating Adobe. |
| URL | hxxps[:]//li[.]tistateronic[.]ru/OqgX/ | Reply URL listed for a 2025 malicious OAuth application named Adobe Drive. |
| URL | hxxps[:]//myworkspacefea7ffc776[.]myclickfunnels[.]com/httpsoutlookofficecom | Reply URL listed for a 2025 malicious OAuth application impersonating DocuSign. |
| URL | hxxps[:]//myworksspace[.]myclickfunnels[.]com/office365com--5b652 | Reply URL listed for a 2025 malicious OAuth application named Users. |
| URL | hxxps[:]//nmcunhasteamworkspace[.]myclickfunnels[.]com/secured-sharepoint-document | Reply URL listed for a 2025 malicious OAuth application named sharedoc. |
| URL | hxxps[:]//topboysteamworkspace[.]myclickfunnels[.]com/sahreddocumentfile | Reply URL listed for a 2025 malicious OAuth application named PDF. |
| URL | hxxps[:]//workspacesteamworkspace[.]myclickfunnels[.]com/office365--4c3dc | Reply URL listed for a 2025 malicious OAuth application impersonating Adobe. |
| URL | hxxps[:]//workspacesteamworkspace[.]myclickfunnels[.]com/offices--af295 | Reply URL listed for a 2025 malicious OAuth application impersonating Adobe. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationMalicious OAuth applications impersonated trusted brands with legitimate-looking names and logos, including Cyrillic homoglyphs.T1078.004 · Cloud AccountsThe described attack flow used valid cloud-account sign-in to a real Microsoft sign-in page before obtaining consent to attacker-controlled applications.T1098.003 · Additional Cloud RolesConsent created attacker-controlled service principals with delegated permissions that persisted beyond the user's session and credentials.T1528 · Steal Application Access TokenAfter users granted consent, attackers obtained OAuth access tokens through the applications' redirect URLs.T1566.002 · Spearphishing LinkThe reported campaigns used phishing emails to lure users to sign in to malicious OAuth applications.T1567 · Exfiltration Over Web ServiceThe article reports that attackers exfiltrated data after gaining access to users' email and files through delegated OAuth permissions.
Vendors
Products
Adobecreates an application in their own Azure environment. They give it a name that looks legitimate, like "Adobe", to make it look like a trustworthy application. To reinforce the illusion of trust, the actor canAzurecompanies impacted across three distinct malicious OAuth App campaigns. It highlights a common gap in how Azure service principals are managed.ClickFunnelsAttackers often hide their landing pages on trusted SaaS platforms like ClickFunnels or GitHub Pages to bypass security filters.DocuSignOne illustrative example is an application that presents itself as a DocuSign integration. Although the application appeared legitimate on its own, evaluating it in a broader context revealed multiple red flags comparedGitHub PagesAttackers often hide their landing pages on trusted SaaS platforms like ClickFunnels or GitHub Pages to bypass security filters.Microsoft EntraOAuth applications in Microsoft Entra ID are a common persistence and privilege escalation mechanism used by attackers.Microsoft OneDriveinvolved 19 distinct OAuth applications impersonating well-known brands such as Adobe, DocuSign, and OneDrive, and targeted multiple organizations. The same campaign was independently reported by the ProofpointMicrosoft TeamsThis is where it gets interesting for security teams. Most of the apps you use, like Microsoft Teams, don’t actually "live" inside your environment. They are hosted inside the developer’s (i.e. Microsoft) Azure