Huntress Research Finds Rogue OAuth Apps Across Azure Tenants
Summary
Huntress surveyed more than 8,000 Azure tenants, finding Traitorware in about 10% and identifying over 500 Stealthware apps across partner tenants. It released Cazadora, an open-source script to audit tenant applications.
Key points
- Azure OAuth applications can be abused through legitimate consent and permission flows; the article says the default configuration allows users to install apps and consent to permissions for their own resource access without review.
- Huntress distinguishes Traitorware—legitimate apps commonly abused by attackers—from Stealthware, custom-built malicious apps tailored to an attack.
- Researchers enumerated more than 8,000 tenants across multiple industries and found Traitorware in about 10% of surveyed tenants.
- The team found that low-prevalence apps with delegated access to a single user were more likely to be Stealthware; considering granted permissions further improved detection.
- Huntress reported identifying more than 500 Stealthware instances across partner tenants using its telemetry and hunting analysis.
- Cazadora uses the administrator’s authentication and the Graph API to enumerate Enterprise Applications and App Registrations and flag suspicious characteristics; Huntress cautions it cannot find every malicious app.
- Suggested audit clues include apps named after users or the tenant, generic names such as “Test,” unusual arbitrary names, and anomalous reply URLs such as http://localhost:7823/access/.
Article Details
- Attack Vectors
- Traitorware: attackers abuse legitimate Azure applications that are commonly used in attacks.
- Stealthware: attackers create custom OAuth applications and tailor their permissions to the intended intrusion.
- In an illicit consent grant attack, a user consents to an application's permissions; a service principal is then installed in the tenant and can access resources within those permissions.
- Defensive Notes
- Audit Enterprise Applications and Application Registrations in Microsoft 365 tenants for apps named after a user or tenant, generic names such as “Test,” arbitrary non-alphanumeric names, or unusual reply URLs, including http://localhost:7823/access/.
- Hunt for rare applications, especially those with less than 1% prevalence across the surveyed tenants, delegated access to a single user, and powerful permissions.
- Use Cazadora to enumerate tenant applications and check for commonly observed suspicious characteristics. The article cautions that it cannot identify every malicious app, and a clean result does not establish that a tenant is safe.
People
Products
Azurethat myself and other staff at Huntress found themselves in when we started to look at the data about Azure applications and how they're used maliciously in our partner tenants. So come along with us for a wildEntra IDphone or on your PC. They’re modular programs designed to do something useful. Apps in Azure hook into Entra ID so your Microsoft 365 account could, for example, use a desktop client that organizes your cloudMicrosoft 365 Apps for EnterpriseTl;dr: If you administer at least one Microsoft 365 tenant, audit your OAuth applications right now. Statistically speaking, there’s a good chance your tenant is infected with a malicious app.