OAuth App Attacks Are the New Phishing in Microsoft 365

A wave of OAuth app attacks tore through the SaaS world in June 2026, and nobody's password got cracked along the way. Attackers compromised Klue, a competitive-intelligence platform that syncs data with Salesforce, stole the OAuth tokens Klue's customers had granted it, and used those tokens to walk straight into connected Salesforce environments. Huntress and LastPass both confirmed stolen CRM data, and new victims kept surfacing into July.

If you run Microsoft 365, don't file this one under "Salesforce problem." The same mechanic works against your tenant today. One employee clicks Accept on a permissions prompt, an attacker's app receives a token, and from then on there's no password to phish and no MFA challenge to beat. The token is the key, and it keeps working until someone revokes it.

This post covers what happened in the June wave, how rogue app consents work in Entra ID, and the four settings that close the door. Most of them cost nothing and take under an hour.

Key Takeaways

• Attackers stole Salesforce CRM data in June 2026 using OAuth tokens alone, no passwords or MFA bypass required.
• Consent phishing gives an attacker's app durable access to mail, files, and contacts in Microsoft 365.
• MFA can't help once a token is granted; consent policies prevent the grant in the first place.
• Restricting user consent and enabling the admin consent workflow in Entra ID costs nothing.
• Audit existing app permissions quarterly; dormant integrations with broad access are attacker gold.

What Happened in the June 2026 Salesforce Data Theft Wave

The short version: attackers didn't breach Salesforce. They breached a vendor that plugs into it. Intruders got into the backend systems of Klue, a competitive-intelligence platform, through a dormant credential left over from a prototype integration, then pushed malicious code that harvested the OAuth tokens customers used to connect Klue's Battlecards product to Salesforce (per BleepingComputer). With those tokens, they queried customer Salesforce environments directly and pulled business contacts, sales communications, price quotes, and subscription details (per Huntress).

The timeline moved fast. Klue spotted anomalous activity on June 11 and alerted customers by June 13. On June 16, extortion emails from a group calling itself Icarus landed at Huntress, threatening to publish stolen data within 48 hours. Salesforce disabled the Klue integration on June 17 (per Dark Reading). Icarus, which claims to have been active since late April 2026, spent the following weeks adding victims to its leak site, and disclosures from affected companies continued into July.

If the pattern feels familiar, it should. The Salesloft Drift compromise hit Salesforce customers the same way in 2025. Stealing OAuth tokens from a SaaS integration vendor has become a repeatable playbook, and CRM data is the prize.

How an OAuth App Attack Works in Microsoft 365

In Microsoft 365, apps request access to your data through OAuth. When a user clicks Accept on a consent prompt, Entra ID records the grant and issues the app tokens that carry those permissions: read mail, send mail as the user, access files, keep working offline. That's the plumbing behind every legitimate integration you use, and it's exactly the plumbing attackers now target.

App consent phishing is the do-it-yourself version of the Klue attack. The attacker registers an application with a plausible name, something like "PDF Viewer Pro" or "Email Security Update," then sends your users a link that opens Microsoft's genuine consent screen. There's no fake login page and no credential harvesting, which is why these lures sail past the checks in our visual guide to spotting phishing emails. Everything on screen is authentic Microsoft. The only fake thing is the app behind the prompt.

One click on Accept and the attacker holds a token that survives password resets, ignores MFA, and quietly reads mail until an admin notices. The second variant is the supply-chain version that just played out against Salesforce: a legitimate vendor you connected years ago gets breached, and the tokens you granted in good faith walk out the door with the attacker.

Out of the box, many Microsoft 365 tenants still let every user consent to third-party apps on their own. That's the door to close, and Entra ID gives you the locks for free.

Lock Down App Consent in Entra ID: Four Moves

1. Restrict user consent

In the Entra admin centre, open Enterprise applications, then Consent and permissions, then User consent settings. Pick "Do not allow user consent," or the middle option that permits consent only for verified publishers requesting low-impact permissions (per Microsoft Learn). For most SMBs we manage, full restriction is the right call. An app permission grant is a data access agreement, and employees shouldn't be signing those on behalf of the company.

2. Turn on the admin consent workflow

Blocking consent without an escape valve trains users to work around IT. The admin consent workflow gives them a "Request approval" button instead of a dead end. Designated reviewers get an email, check the publisher, the permissions, and the business case, then approve or deny (per Microsoft Learn). Name at least two reviewers so requests don't rot in one person's inbox, and set request expiry to 30 days.

3. Audit the apps already in your tenant

Consent settings only govern future grants. Open Enterprise applications and review what's already connected, paying close attention to anything holding Mail.Read, Mail.Send, offline_access, or Files.Read.All. For each app, ask three questions: who consented, is the vendor still in use, and would anyone notice if you revoked it tomorrow? Dormant integrations with broad permissions are exactly what the Klue attackers monetized. If you'd rather have a second set of eyes, our cybersecurity services include this audit as part of tenant hardening.

4. Add app governance if your licensing includes it

App governance, a capability of Microsoft Defender for Cloud Apps, watches OAuth apps after the grant: overprivileged permissions, unused high-privilege access, and unusual API activity all raise alerts (per Microsoft Learn). It ships with Microsoft 365 E5 and is available as an add-on for other plans. Think of it as the difference between locking the door and locking the door plus keeping a camera on it.

The Law 25 Angle for Quebec Businesses

A CRM is a database of personal information: names, work emails, phone numbers, sometimes buying history and contract values. If an OAuth attack empties yours, Law 25's breach obligations kick in. You'll need to assess the risk of serious injury, notify the Commission d'accès à l'information and affected individuals where required, and record the incident in your registry. Our guide to Law 25 and Microsoft 365 walks through that framework in detail.

The practical takeaway: consent hygiene is now a privacy compliance task on top of a security one. Reviewing app grants once, then never again, doesn't hold up. Under a managed IT service, these reviews happen on a schedule instead of after an incident.

FAQ

What is consent phishing in Microsoft 365?

Consent phishing tricks a user into approving a malicious app's permission request instead of stealing a password. The user clicks Accept on a real Microsoft consent screen, and Entra ID issues the attacker's app a token with the granted permissions, such as reading mail or files. That access persists until an administrator revokes the app, and changing the password doesn't affect it.

Does MFA stop OAuth app attacks?

No. MFA protects the sign-in, and in a consent phishing scenario the sign-in is legitimate: the user really is on Microsoft's login page. The token issued after consent works without any further MFA challenges. Consent policies, the admin consent workflow, and regular app audits are the controls that address this class of attack.

How do I see which apps have access to my Microsoft 365 data?

In the Entra admin centre, open Enterprise applications for the tenant-wide list, then check each app's Permissions tab to see what was granted and by whom. Individual users can review their own grants at myapps.microsoft.com. Administrators can also export every OAuth grant with Microsoft Graph PowerShell for a complete audit.

Should a small business disable user consent entirely?

In most cases, yes. Employees rarely have the context to judge whether an app's permission request is reasonable, and one wrong click grants durable access to company data. Pair the restriction with the admin consent workflow so legitimate requests get reviewed quickly, usually within a business day, and users never feel the need to work around IT.

Sources

• BleepingComputer: Klue OAuth breach linked to Icarus Salesforce data theft attacks
• Huntress: Cybercrime breaches Klue, Salesforce data impacted for many victims
• Dark Reading: Salesforce data thefts continue via Klue app compromise
• CM-Alliance: June 2026 biggest cyber attacks and data breaches
• Microsoft Learn: Configure how users consent to applications
• Microsoft Learn: Configure the admin consent workflow
• Microsoft Learn: App governance in Microsoft Defender for Cloud Apps

The Salesforce wave proved attackers don't need your passwords anymore, just one approved app. An hour in the Entra admin centre closes most of that exposure. If you'd like a second opinion on your tenant's consent settings and existing app grants, book a free IT assessment and we'll show you exactly what's connected to your data.