The latest attack attempts to trick Office 365 users that use Coinbase into giving access to their mailbox via a Consent app rather than trying to steal their credentials. In the latest attack, users receive an email impersonating Coinbase asking users to update their terms of service. Upon clicking the link to review the new ToS, users are taken to a legitimate Office 365 logon page and are then presented with a request for accessing the user’s mailbox and information, citing “coinbaseterms.app” as the requestor (to keep with the ruse that this is about updating Coinbase terms of service).
Once access is granted, the app now has access to read the victim’s emails, delete messages, and more. The only way to remove access is administratively.