Rewterz Threat Alert – Office 365 OAuth Phishing Campaign Compromises Emails

Severity

High

Analysis Summary

The latest attack attempts to trick Office 365 users that use Coinbase into giving access to their mailbox via a Consent app rather than trying to steal their credentials. In the latest attack, users receive an email impersonating Coinbase asking users to update their terms of service. Upon clicking the link to review the new ToS, users are taken to a legitimate Office 365 logon page and are then presented with a request for accessing the user’s mailbox and information, citing “coinbaseterms.app” as the requestor (to keep with the ruse that this is about updating Coinbase terms of service).

Once access is granted, the app now has access to read the victim’s emails, delete messages, and more. The only way to remove access is administratively.

Impact

• Unauthorized Access
• Credential Theft
• Email Compromise

Remediation

• Only grant access to legitimate app publishers (such as Outlook for mobile devices).
• Do not respond to emails coming from untrusted email addresses even if the content of email looks legitimate.