Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis reveals the growing threat of malicious OAuth applications in Microsoft Entra ID, which attackers use for persistence and privilege escalation. The report details how these apps blend in with legitimate integrations, making detection challenging. It describes the creation of OAuth Apps Scout, an automated detection pipeline that identifies emerging malicious OAuth apps. The research uncovered multiple campaigns, including one involving 19 apps impersonating well-known brands. The report compares tactics from 2019 to 2025, showing an evolution in attacker strategies from Microsoft impersonation to third-party SaaS spoofing. It concludes with actionable defense strategies for organizations to protect against these threats.

This threat involves malicious OAuth applications targeting Microsoft Entra ID (formerly Azure Active Directory) environments. Attackers create OAuth apps that request permissions to access organizational resources, leveraging OAuth consent flows to gain persistent access and escalate privileges. These malicious apps are crafted to closely resemble legitimate integrations, including impersonation of well-known brands and SaaS providers, making them difficult to detect through conventional means. The research highlights a shift in attacker tactics from 2019 to 2025, moving from direct Microsoft impersonation to more sophisticated third-party SaaS spoofing. The OAuth Apps Scout automated detection pipeline was developed to identify emerging malicious OAuth apps by analyzing app metadata, consent patterns, and behavioral indicators. The campaigns uncovered include one with 19 malicious apps impersonating trusted brands to deceive users into granting consent. The abuse of OAuth consent mechanisms enables attackers to bypass traditional authentication controls, maintain long-term persistence, and perform privilege escalation within cloud environments. The threat leverages techniques such as consent phishing (T1566, T1204.001), token manipulation (T1550, T1550.001), and application impersonation (T1534). Detection is challenging due to the legitimate appearance of these apps and the complexity of OAuth flows. The report concludes with defense strategies including continuous monitoring of OAuth app registrations, implementing strict consent policies, and leveraging automated detection tools like OAuth Apps Scout to identify anomalous or suspicious OAuth applications.

Detailed information about Uncovering Malicious OAuth Campaigns in Entra ID. Get real-time updates, technical details, and mitigation strategies.

Uncovering Malicious OAuth Campaigns in Entra ID - Live Threat Intelligence - Threat Radar | OffSeq.com

Uncovering Malicious OAuth Campaigns in Entra ID

Threats Tagged 'consent abuse'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'consent abuse'

Lead Pen Test Professional