Microsoft warns of large 'Upgrade' phishing campaign

By

Machine learning picks up on suspicious OAuth use by app.

Microsoft is warning that its security intelligence service is seeing a phishing campaign currently targeting hundreds of organisations.

Microsoft warns of large 'Upgrade' phishing campaign

An app named "Upgrade" abuses OAuth request links, and Microsoft said its machine learning technology picked up on this suspicious behaviour.

Users are asked to grant consent to "Upgrade" which would then read their emails as well as write them, and create inbox rules like forwarding all or specific messages to another account to exfiltrate data.

OAuth or Open Authorisation is an open standard access delegation method that lets websites share information without revealing users' passwords. 

The attack was reported to Microsoft by a pseudonymous security researcher called TheAnalyst, who said it targeted users for a month.

"Upgrade" is signed by Cardthartic LLC, with the attacker using the viox.dev domain as well, TheAnalyst noted.

Microsoft has deactivated the app in Azure Active Directory, and notified affected customers.

It is not yet known who is behind the phishing attack.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Researchers demo AI-crippling GPUHammer attack

Researchers demo AI-crippling GPUHammer attack

Qantas obtains court order to prevent third-party access to stolen data

Qantas obtains court order to prevent third-party access to stolen data

Google Gemini for Workspace vulnerable to prompt injection attacks

Google Gemini for Workspace vulnerable to prompt injection attacks

Log In

  |  Forgot your password?