A phishing campaign gained access to victim accounts when the victims granted the app access to their Office 365 account. Phishing emails were sent to potential victims and contained a link to what was advertised as a legitimate SharePoint or OneDrive file share. When the victim clicks on the link, they are sent to a legitimate Microsoft login page. After the victim logged in (or if they were previously logged in), they were presented with a “Permissions requested” page that the app in the URL required. Clicking the Accept button essentially granted the app (and therefore the attackers) full access to the Office 365 account. In addition, any single sign on (SSO) service that leveraged the victim’s Office 365 credentials could then be accessed by the attackers. PhishLabs indicated that just changing the account password does not close this window into the account – the victim must disassociate the app from the account.