Hackers Using OAuth Apps in Microsoft Entra ID to Establish Persistence

Hackers are increasingly abusing OAuth applications in Microsoft Entra ID to gain persistent access, blending in as normal “business integrations” while keeping access even after defenders reset passwords.

Recent Wiz research and incident reporting show attackers using fake OAuth apps, deceptive consent prompts, and redirect URLs to steal tokens and maintain long-term footholds in Microsoft 365 environments.

How the persistence works

In Microsoft Entra ID, an app registration creates an application object in the app’s “home” tenant. That application object acts as a blueprint for service principals created in other tenants where the app is used.

A service principal is the local identity for the app in a tenant and defines what the app can do in that tenant, including which resources it can access once permissions are granted through registration or consent.​

Attackers exploit this model by convincing a user (or admin) to grant consent to a malicious or attacker-controlled OAuth app, which can establish an integration that functions like an always-on access path.

MITRE notes adversaries can use OAuth app integrations for persistence, including by granting consent from a high-privileged account to maintain access even if they later lose that account.

In some cases, these integrations can remain valid even after the original consenting user is disabled, and they may also help bypass MFA via application access tokens.

Wiz recently described real-world tricks that make a consent screen look legitimate. However, the app name uses a trick such as starting with a zero instead of the letter “O.”

Introduced a detection pipeline called “OAuth Apps Scout” to surface emerging malicious OAuth applications.​ Threat reporting from Proofpoint tied fake Microsoft OAuth applications to campaigns observed in early 2025.

Impersonated apps (including Adobe and DocuSign themes) redirected victims into attacker-in-the-middle phishing flows using kits such as Tycoon.

Proofpoint reported attempted account compromises affecting nearly 3,000 user accounts across more than 900 Microsoft 365 environments in 2025, with a confirmed success rate exceeding 50%.​

Defensive steps

Microsoft’s consent model allows admins to decide whether user consent is required and to enforce conditions that require administrator review and approval.

Enabling an admin consent workflow can force “approval required” prompts when users aren’t allowed to consent, shifting risky app authorization decisions to designated reviewers.​

Operationally, defenders should treat OAuth apps and service principals as inventory that must be continuously reviewed.

With special scrutiny for new or low-prevalence apps, unusual redirect/reply URLs, and high-impact permissions that don’t match an app’s stated purpose.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.