Researchers documented more than 200 emails hitting roughly 120 organizations in two weeks, with no fake login page anywhere in the chain.

 

What happened

A phishing campaign has been routing victims through Microsoft's real sign-in page rather than a counterfeit one, Cybernews reported on July 30, 2026. The lure arrives styled as a Teams notification from HR, with a sender name reading "There's New Activity On Team" and a subject line claiming three messages were sent via Teams chat. Body copy mimics Teams formatting and references a payroll and benefits update alongside a counter showing four overdue employee tasks. Clicking through lands the recipient on login.microsoftonline.com, where they are asked to approve an application. Researchers counted more than 200 unique emails across roughly 120 organizations inside a two-week window, hitting North American organizations across legal services, non-profits, and other sectors.

 

Going deeper

Approving that application hands over access without any password changing hands. OAuth consent is the ordinary mechanism letting one application request limited access to another, the same process a calendar tool uses when it asks permission to read your availability. An attacker registers an application, gives it a plausible name, and directs the target to a genuine authorization screen. Once consent is granted, the application receives an authorization code it exchanges for an access token and often a refresh token, and it can then call APIs on the user's behalf, as Microsoft describes in its guidance on the technique. The application keeps working when the user signs out, since it is acting under its own grant rather than riding a session. In this campaign, that meant access to mail, Teams, SharePoint, OneDrive, and calendar.

 

What was said

"Attackers have stopped forging Microsoft's front door and started walking through it," researchers wrote in findings reported by Cybernews on July 30, 2026. They described the technique as having moved during 2026 from bespoke work by capable attackers to something available for rent, and noted it is a named entry in the MITRE ATT&CK framework rather than a novel discovery. The campaign is no longer active.

 

In the know

Standard incident response does close to nothing here, which is the part worth internalizing before an organization needs it. Resetting the password leaves the grant intact, and so does revoking sessions, because the application holds its own authorization independent of the user's login. Remediation requires removing the OAuth consent grant, deleting the associated service principal from the directory, revoking refresh tokens, and blocking the application, according to Microsoft's incident response playbook for app consent grants. Microsoft also points administrators to a script that exports every consent grant across a tenant to a single file, which is the fastest way to find out what is already there. Users can review their own approved applications at myapps.microsoft.com and revoke access themselves.

 

The big picture

Healthcare organizations run large tenants with many legitimate integrations, from scheduling tools to transcription services to analytics connectors, so an additional application in the list attracts no attention. The preventive control is an admin consent workflow, which stops users from granting access on their own and routes requests to an administrator for review, paired with periodic audits of which applications hold what permissions. Payroll and benefits lure work in every sector because everyone has an HR department and nobody wants to be the person who ignored a compensation notice. Awareness training that teaches staff to check the address bar gives them nothing to catch here, since the address bar is correct and the only false element is the intent behind the application asking for access.

 

FAQs

How is consent phishing different from a stolen session token?

A stolen token expires and is tied to a sign-in event visible in authentication logs. A consent grant creates a durable object in the directory that persists until someone removes it, and investigating it requires reviewing application permissions and audit logs rather than sign-in records.

 

Does multifactor authentication stop this?

No. The victim completes genuine authentication, including any multifactor step, because the attacker is not trying to become the user. The dangerous action happens after a successful login, when the user approves permissions for an application.

 

What permissions should raise concern in a consent prompt?

Requests to read or send mail, read all files the user can access, maintain access to data the user has given it access to, or read directory data. The offline access permission is worth particular attention, since it is what allows an application to keep working when the user is not present.

 

Can an organization tell whether users have already approved something malicious?

Yes. Administrators can inventory consent grants across the tenant through the Entra admin center or PowerShell, then review each application's publisher, verification status, and permission scope. Applications from unverified publishers holding broad mail or file permissions warrant investigation first.