Microsoft Warns of Hackers Exploiting OAuth for Cryptocurrency Mining and Phishing

Dec 13, 2023NewsroomCryptocurrency / Menace Evaluation

Microsoft has warned that adversaries are utilizing OAuth functions as an automation device to deploy digital machines (VMs) for cryptocurrency mining and launch phishing assaults.

“Menace actors compromise consumer accounts to create, modify, and grant excessive privileges to OAuth functions that they will misuse to cover malicious exercise,” the Microsoft Menace Intelligence crew stated in an evaluation.

“The misuse of OAuth additionally allows menace actors to take care of entry to functions even when they lose entry to the initially compromised account.”

OAuth, brief for Open Authorization, is an authorization and delegation framework (versus authentication) that gives functions the flexibility to securely entry info from different web sites with out handing over passwords.

Within the assaults detailed by Microsoft, menace actors have been noticed launching phishing or password-spraying assaults towards poorly secured accounts with permissions to create or modify OAuth functions.

One such adversary is Storm-1283, which has leveraged a compromised consumer account to create an OAuth software and deploy VMs for cryptomining. Moreover, the attackers modified present OAuth functions to the account had entry to by including an additional set of credentials to facilitate the identical targets.

In one other occasion, an unidentified actor compromised consumer accounts and created OAuth functions to take care of persistence and to launch electronic mail phishing assaults that make use of an adversary-in-the-middle (AiTM) phishing package to plunder session cookies from their targets and bypass authentication measures.

“In some circumstances, following the stolen session cookie replay exercise, the actor leveraged the compromised consumer account to carry out BEC monetary fraud reconnaissance by opening electronic mail attachments in Microsoft Outlook Internet Utility (OWA) that include particular key phrases akin to ‘cost’ and ‘bill,” Microsoft stated.

Different eventualities detected by the tech large following the theft of session cookies contain the creation of OAuth functions to distribute phishing emails and conduct large-scale spamming exercise. Microsoft is monitoring the latter as Storm-1286.

To mitigate the dangers related to such assaults, it is beneficial that organizations implement multi-factor authentication (MFA), allow conditional entry insurance policies, and routinely audit apps and consented permissions.