Microsoft disabled multiple fraudulent, verified Microsoft Cloud Partner Program accounts for creating malicious OAuth apps used to steal customers' emails
Bill Toulas / BleepingComputer :
Context & Ripple Effects
Microsoft’s action targets abuse of trust signals inside its Cloud Partner Program: verified partner accounts were used to create OAuth applications that accessed customer email. It sits alongside a large Office 365 authentication-hijacking campaign that reached organizations even where MFA was enabled.
Later related coverage shows the abuse pattern persisted beyond these accounts, with Microsoft warning that OAuth apps were being used for phishing, spam, and crypto-mining automation. The immediate takedown therefore matters as an enforcement response to an application-permission attack surface, not merely a bad-account cleanup.
First-order effects
- Microsoft has removed the fraudulent partner accounts and the malicious OAuth apps tied to them, cutting off the identified route used to steal customer email.
- Affected customers must treat consent granted to those apps as compromised access, while legitimate Cloud Partner Program members face a more security-sensitive verification environment.
Second-order effects
- Microsoft’s warning about OAuth apps used to automate phishing and other abuse raises pressure on the company to detect harmful behavior after app registration, rather than relying on partner verification alone.
- Attackers seeking Microsoft customer data lose one set of verified accounts but retain an incentive to shift toward other OAuth and authentication-session techniques, including the Office 365 flow previously targeted.
Third-order effects
- The pattern points to identity security moving beyond passwords and MFA toward tighter governance of app consent, token use, and the trust programs that authorize third-party software.
- If repeated OAuth abuse drives stricter app approval and monitoring, cloud partner ecosystems will trade some onboarding convenience for controls designed to limit delegated-access attacks.
The trend: Enterprise identity attacks are increasingly focused on delegated application permissions and authenticated sessions rather than simply defeating user passwords.