What is malicious OAuth access?¶
Malicious OAuth access occurs when an application obtains cloud permissions through an OAuth authorisation process and then uses them for unauthorised or harmful activity.
OAuth is a legitimate framework used to let applications act on a user’s behalf without receiving the password.
What this means in practice¶
The provider may have correctly issued access after the user or administrator approved the application. The problem may be that the application was deceptive, compromised or granted excessive permissions.
A malicious application may read email, access files, collect contacts, send messages or maintain continuing access through refresh tokens.
Where the service is live, coordinate preservation and containment. Removing access may be urgent, but relevant consent, token and audit records should be captured first where possible.
What this may show¶
The cloud logs may show the application identifier, publisher information, consent time, permissions, token issue, account involved and later actions.
What this does not show on its own¶
The dangerous assumption is that activity authorised through OAuth must be safe because the cloud provider issued the token.
Do not rely only on the application’s displayed name. Names can be copied or changed. The underlying application or client identifier is usually more reliable.
Password changes may not end malicious OAuth access. The application permission and associated tokens may need to be revoked separately.
What to do next¶
Establish who granted consent, whether the approval was individual or organisation-wide, what permissions were requested and whether administrators reviewed the application.
Check whether the application accessed several users or tenants. A single administrator approval may expose a wider environment.
Key takeaway
Malicious OAuth access uses legitimate delegated-authorisation mechanisms for harmful purposes, so trace the application ID, consent, permissions, tokens and resulting activity.