Attackers sent emails that looked like Microsoft Teams/HR notifications and pushed users through Microsoft’s real sign-in and OAuth consent screens. When victims approved the requested permissions, the attackers obtained an authorization token and could access Microsoft 365 data like Outlook, SharePoint, and OneDrive. The compromised mailbox could also be used as a launchpad for business email compromise (BEC).
This campaign impersonated Microsoft Teams and Planner notifications, framing the email as if a company's HR department had sent messages through Teams. The sender display name read "There's New Activity On Teams," and the body referenced overdue tasks to create a sense of urgency. Instead of directing victims to a fake login page, the attackers routed them through Microsoft's real OAuth authorization flow. Once a user signed in, they were presented with a legitimate-looking prompt to "Approve permissions" or "Accept on behalf of your organization." Approving that request handed the attacker a valid authorization token without ever exposing a password.
Using Microsoft's own sign-in and consent screens removed one of the most reliable red flags defenders rely on: a suspicious or spoofed login page. Because the URLs and screens were authentic, technical inspection alone would not have revealed the malicious intent. The urgency created by referencing "overdue tasks" added pressure, and the HR/Teams framing made the message feel routine and internal rather than external and suspicious. The campaign reached users across manufacturing, legal, and healthcare organizations, suggesting a broad, opportunistic targeting approach rather than a narrowly tailored one.
Once an attacker obtains an OAuth authorization token, they can access Microsoft 365 data such as Outlook, SharePoint, and OneDrive, and a compromised mailbox can be reused for business email compromise. Because this method does not require stealing a password, awareness needs to extend beyond password hygiene:
These habits are especially relevant for finance, HR, executive assistants, and IT helpdesk or identity teams, who are frequently targeted because of the access and approvals tied to their roles.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers sent emails disguised as Microsoft Teams and Planner notifications from a company's HR department, then routed victims through Microsoft's legitimate OAuth authorization flow to request permissions.
Because the sign-in and consent screens were Microsoft's actual pages rather than fake login clones, the request looked trustworthy while the attacker still received an authorization token upon approval.
With a valid authorization token, attackers could access Microsoft 365 data such as Outlook, SharePoint, and OneDrive, and use the compromised mailbox as a launchpad for business email compromise.
The campaign targeted users at 120 organizations in manufacturing, legal services, and healthcare.
You get an email: sender name says “There’s New Activity On Teams,” and HR supposedly pinged you about overdue tasks. You click, and here’s the sneaky part: it sends you to Microsoft’s real sign-in and OAuth consent screens, asking to “Approve permissions” or even “Accept on behalf of your organization.” If you approve, you’ve basically handed an attacker an authorization token, so they can quietly read your Outlook, SharePoint, and OneDrive, and even use your mailbox for business email compromise. So if an email about Teams or HR tasks pushes urgency and then pops an unexpected Microsoft “Approve permissions” screen, stop, close it, and open Teams or Planner directly yourself to check.
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
The article describes how real-world phishing and social engineering are evolving to bypass the checks employees are trained to use (bad grammar, suspicious URLs, obvious fake login pages). It highlights specific, observed attack workflows including QR-code “device hop” phishing, OAuth token theft…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
