Malicious Office 365 Apps Are the Ultimate Insiders
Summary: Phishing links aimed at Microsoft Office 365 users now load the victim's real organization login page, then prompt them to install an innocuously named malicious app that grants persistent, password-free access to their email and files. Proofpoint reported that 55 percent of its customers have faced these malicious app attacks, and about 22 percent of those attacked were successfully compromised, with the apps bypassing multi-factor authentication and surviving password resets.
Key Takeaway: An attacker who gets a user to click approve holds a foothold that a password reset and MFA do not remove, and Proofpoint's Ryan Kalember said roughly one in five attacked organizations was successfully compromised. Microsoft's own guidance calls blocking third-party app installs a "drastic step" that impairs productivity, so the control that closes this path is one many tenants leave off.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026