TLDR
The CSIRT Italia has documented a consent phishing campaign targeting Microsoft 365 users and administrators. The criminals register a malicious app in Microsoft Entra ID and, through targeted emails or compromised web portals, induce the...
How it works
The CSIRT Italia has documented a consent phishing campaign targeting Microsoft 365 users and administrators. The criminals register a malicious app in Microsoft Entra ID and, through targeted emails or compromised web portals, induce the...
Red flags
- Urgent pressure to click, pay, or share codes immediately.
- A link or sender that does not match the official organization.
- Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What to do
- 13 recommended actions Always verify the developer name, URL, and scope before clicking "Accept" on any Microsoft consent screen.
Source
csirt-italia
Source reviewed by Mythos Forensic Team
https://www.acn.gov.it/portale/w/microsoft-entra-id-sfruttamento-di-tecniche-di-consent-phishing-per-l-acquisizione-di-autorizzazioni-applicativeFAQ
Is Microsoft Entra ID: consent phishing attack to gain application permissions on M365 a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What should I do first?
3 recommended actions Always verify the developer name, URL, and scope before clicking "Accept" on any Microsoft consent screen.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.