Proofpoint details BluePhishing attack on Microsoft Entra agent identities
One admin consent can create persistent agent identities; Proofpoint reports no observed real-world use.
Stories per day · 30 days
1 RSS
6 stories, newest first · one card per story
Stories tagged #consent-phishing
The devil is still in the email – but wearing a new mask
ESET details modern phishing evolution: QR codes, OAuth token theft via ConsentFix, ClickFix paste attacks, and deepfake-assisted BEC.
3
Webinar: How malicious OAuth apps can lead to Google Workspace breaches
BleepingComputer webinar will dissect two Google Workspace breaches caused by malicious OAuth apps and social engineering, hosted September 23 with Material Security.
1
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.
5
Attackers are going after prominent individuals through OAuth phishing, FBI warns
FBI IC3 warns of ongoing OAuth consent phishing since late 2025 targeting prominent individuals to gain persistent, password-free account access.
1
FBI raises alarm over deceptive phishing campaign targeting prominent people
The FBI warns of an ongoing OAuth consent phishing campaign granting attackers persistent access to high-profile victims' cloud accounts without passwords.
1