A novel attack vector has been seen in the wild: using OAuth permissions to compromise Office365 Accounts

Reported by anti-phishing security firm PhishLabs, the new attack leverages the persistent permissions of OAuth authentication to get access to the target Office365 accounts without ever compromising the login credentials.

The attack starts with a phishing email which pretends to be a file shared for a Sharepoint site or OneDrive.  These emails have often been customised with the name of the target organisation, increasing the chance they will be clicked.  Embedded phishing link actually points to a malicious Office365 App (plug-in).

By default, all Office365 users can install plug-ins for Outlook, and these can be side loaded direct from a URL without going through the Microsoft Office Store.  In the case of this attack, the phishing link in the email points to the installation URL for the malicious app.  However, the URL is actually the legitimate Office365 domain with a parameter which is the source URL for the app.  A cursory check by a user hovering their mouse over the link in their email will see the real Office365 domain as the target.

As you can see from this sanitised example, the target URL is not obvious:

hXXps://login{dot}microsoftonline{dot}com/common/oauth2/v2.0/authorize?
%20client_id=fc5d3843-d0e8-4c3f-b0ee-6d407f667751&
response_type=id_token+code&
redirect_uri=https%3A%2F%2Fofficemtr.com%3A8081%2Foffice&
scope=offline_access%20contacts.read%20user.read%20mail.read%20
notes.read.all%20mailboxsettings.readwrite%20Files.ReadWrite.All%20
openid%20profile&state=12345Ajtwmd&response_mode=%20form_post&
nonce=YWxsYWh1IGFrYmFy

The source url for the malicious app is at officemtr{dot}com:8081/office

When the user clicks the link, they are first taken to the legitimate Office365 login page to enter their credentials, and then are presented with an application permissions box to approve the plug-in installation.  If the user simply accepts the permissions the app is installed into their Office365 with sweeping permissions to access their files and emails.

Because the malicious app is using persistent OAuth permissions, changing the user’s password or activating two factor authentication will not affect the access the app has.

Microsoft offers detailed guidance for Office365 Administrators to hunt down and disable malicious OAuth applications in their environment.