The Shift in Phishing Tactics

A recent phishing campaign identified by Check Point Research highlights a dangerous evolution in cyberattacks. Unlike traditional schemes that rely on fake websites or credential harvesting, this operation successfully directs victims to genuine Microsoft sign-in pages. By doing so, attackers effectively neutralize standard user security training that emphasizes inspecting URLs and checking for security certificates.


The campaign, which occurred between late June and July 2026, targeted over 120 organizations globally. Rather than attempting to steal passwords or bypass multi-factor authentication (MFA) through interception, the attackers leveraged a method known as consent phishing.


How the Attack Unfolds

The phishing emails were disguised as legitimate notifications from Microsoft Planner, claiming that HR had sent important messages via Teams or that there were overdue employee tasks. Once a recipient clicked a link in the email, they were directed to a real login.microsoftonline.com authorization page.


Upon arrival at the legitimate Microsoft portal, the user was presented with an OAuth permissions prompt. The prompt requested authorization for an app controlled by the attackers. If a user accepted, they inadvertently granted the threat actors access to sensitive data—including emails, files, calendars, and OneDrive content—without the attackers ever needing to handle a password or a second-factor code.


“The domain and certificate are Microsoft's, while the sign-in page is the one the user sees every morning, offering a false sense of security,” the report explains.

Bypassing Traditional Defenses

This tactic poses a significant challenge for modern security training. Since the environment is entirely authentic, common red flags—such as misspelled domains or suspicious padlock icons—are absent. Because the victim provides consent during an active, authenticated session, traditional MFA protocols offer no protection against the illicit grant of permissions.


Recommended Mitigations

According to researchers, this technique has become a commoditized service, meaning it is likely to persist even as specific campaigns end. To defend against this threat, organizations should focus on the following strategies:

  • Restrict App Consent: System administrators should configure Microsoft Entra to limit the types of permissions applications can request, preventing unauthorized third-party apps from gaining broad access to enterprise data.
  • User Awareness: Employees must be educated to treat every permission or consent prompt with extreme caution, verifying the identity of the requesting application before clicking 'Accept.'