Proofpoint, Thursday, July 31st, 2025
Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing
Proofpoint has identified a cluster of activity using Microsoft OAuth application creation and redirects that lead to malicious URLs enabling credential phishing. The fake Microsoft 365 applications impersonate various companies including RingCentral, SharePoint, Adobe, and DocuSign. Proofpoint first observed this activity in early 2025 and remains ongoing.
more →