專家警告稱，新的網絡釣魚和 OAuth 漏洞威脅 Microsoft 365 安全

網絡釣魚攻擊正在不斷發展，利用 OAuth 缺陷繞過 Microsoft 365 防禦並獲得持久的帳戶訪問權限。了解最新的威脅以及如何保護自己。

New Phishing and OAuth Exploits Threaten Microsoft 365 Security, Experts Warn

專家警告稱，新的網絡釣魚和 OAuth 漏洞威脅 Microsoft 365 安全

In a concerning development for digital security, a new wave of sophisticated attacks is targeting Microsoft 365 accounts by cleverly combining phishing tactics with vulnerabilities in OAuth authentication tokens. Cybersecurity researchers are sounding the alarm, highlighting how attackers are chaining seemingly minor web flaws with advanced social engineering to bypass traditional security measures and gain persistent access to sensitive cloud services.

在令人擔憂的數字安全發展中，新一波複雜的攻擊通過巧妙地將網絡釣魚策略與 OAuth 身份驗證令牌中的漏洞結合起來，針對 Microsoft 365 帳戶。網絡安全研究人員拉響了警報，強調攻擊者如何將看似微小的網絡缺陷與先進的社會工程聯繫起來，以繞過傳統的安全措施並獲得對敏感雲服務的持續訪問。

The Evolving Phishing Landscape

不斷變化的網絡釣魚格局

Email continues to be a primary vector for cyberattacks, but with enhanced filters and authentication protocols like SPF and DMARC, traditional phishing methods are becoming less effective. Attackers have adapted by exploiting legitimate business logic and web application features. Researchers have identified methods where attackers manipulate input fields in public-facing API endpoints. This allows them to trick an organization's own infrastructure into sending malicious emails that, because they originate from authorized servers, bypass security checks and land directly in the victim's inbox. This technique cleverly leverages the inherent trust in an organization's domain.

電子郵件仍然是網絡攻擊的主要媒介，但隨著過濾器和身份驗證協議（如 SPF 和 DMARC）的增強，傳統的網絡釣魚方法變得越來越無效。攻擊者通過利用合法的業務邏輯和 Web 應用程序功能進行了調整。研究人員已經確定了攻擊者操縱面向公眾的 API 端點中的輸入字段的方法。這使得他們能夠欺騙組織自己的基礎設施發送惡意電子郵件，因為這些電子郵件來自授權服務器，因此繞過安全檢查並直接進入受害者的收件箱。該技術巧妙地利用了組織領域中固有的信任。

OAuth Token Abuse: A New Frontier

OAuth 令牌濫用：新領域

A significant part of this new threat lies in the abuse of OAuth 2.0 tokens. These tokens function as trusted credentials, allowing services to access user accounts without requiring passwords, often seen in features like "Continue with Microsoft." However, attackers are tricking users into granting these access tokens to attacker-controlled applications through malicious phishing emails. Once an attacker possesses a valid OAuth token, they can access sensitive data such as emails, files, and calendars. Crucially, traditional security measures like changing passwords or enabling multi-factor authentication (MFA) do not automatically revoke these tokens, allowing attackers to maintain access until the token is manually revoked or expires. This can lead to full account takeovers and lateral movement within corporate networks.

這種新威脅的一個重要部分在於 OAuth 2.0 令牌的濫用。這些令牌充當可信憑據，允許服務無需密碼即可訪問用戶帳戶，這通常出現在“繼續使用 Microsoft”等功能中。然而，攻擊者通過惡意網絡釣魚電子郵件欺騙用戶將這些訪問令牌授予攻擊者控制的應用程序。一旦攻擊者擁有有效的 OAuth 令牌，他們就可以訪問敏感數據，例如電子郵件、文件和日曆。至關重要的是，更改密碼或啟用多重身份驗證 (MFA) 等傳統安全措施不會自動撤銷這些令牌，從而允許攻擊者保持訪問權限，直到令牌被手動撤銷或過期。這可能會導致公司網絡內的全面帳戶接管和橫向移動。

Weaponizing Device Codes and API Flaws

武器化設備代碼和 API 缺陷

Recent campaigns have specifically highlighted the weaponization of OAuth device code flows, a feature designed for devices with limited input capabilities. Attackers send phishing messages with URLs or QR codes that initiate an OAuth grant on a legitimate login page. When victims enter the displayed code, believing it to be safe, attackers receive the OAuth access token tied to their account. Furthermore, a specific attack chain involves pairing this email flaw with improper error handling in cloud environments. When applications display verbose errors for debugging, malformed requests can inadvertently leak sensitive authentication tokens, like JSON Web Tokens (JWTs) used for Microsoft Graph API communication, alongside stack traces. These tokens grant immediate, authenticated access without triggering login alerts.

最近的活動特別強調了 OAuth 設備代碼流的武器化，這是一項專為輸入功能有限的設備設計的功能。攻擊者發送帶有 URL 或 QR 代碼的網絡釣魚消息，在合法登錄頁面上啟動 OAuth 授權。當受害者輸入顯示的代碼並相信它是安全的時，攻擊者就會收到與其帳戶綁定的 OAuth 訪問令牌。此外，特定的攻擊鏈涉及將此電子郵件缺陷與雲環境中的不當錯誤處理配對。當應用程序顯示詳細的調試錯誤時，格式錯誤的請求可能會無意中洩漏敏感的身份驗證令牌，例如用於 Microsoft Graph API 通信的 JSON Web 令牌 (JWT) 以及堆棧跟踪。這些令牌可立即授予經過身份驗證的訪問權限，而不會觸發登錄警報。

Defending Against the Threat

防禦威脅

To combat these evolving threats, cybersecurity experts recommend several key strategies. Organizations must enforce strict input validation on all public APIs to ensure they only accept the minimum necessary parameters. Production environments should be configured to return generic error messages, suppressing detailed debug information that could leak credentials. While standard OAuth 2.0 is a backbone for API security, its limitations in scenarios requiring person-to-person delegation are becoming apparent. Solutions like User-Managed Access (UMA) 2.0, which adds a centralized policy layer to OAuth, are gaining traction for enabling more granular and secure sharing. Ultimately, staying vigilant, educating users about phishing risks, and implementing robust API security and error handling practices are paramount in safeguarding Microsoft 365 accounts and other cloud services.

為了應對這些不斷變化的威脅，網絡安全專家推薦了幾種關鍵策略。組織必須對所有公共 API 執行嚴格的輸入驗證，以確保它們只接受最少的必要參數。生產環境應配置為返回一般錯誤消息，從而抑制可能洩露憑據的詳細調試信息。雖然標準 OAuth 2.0 是 API 安全性的支柱，但它在需要人對人委託的場景中的局限性正變得越來越明顯。用戶管理訪問 (UMA) 2.0 等解決方案為 OAuth 添加了集中式策略層，在實現更精細、更安全的共享方面獲得了廣泛關注。最終，保持警惕、教育用戶有關網絡釣魚風險以及實施強大的 API 安全和錯誤處理實踐對於保護 Microsoft 365 帳戶和其他雲服務至關重要。

So, while the digital world keeps throwing new curveballs, a little awareness and some solid security hygiene can go a long way. Stay safe out there, and maybe think twice before clicking that link!

因此，儘管數字世界不斷拋出新的曲線球，但一點意識和一些可靠的安全衛生措施可以大有幫助。保持安全，在點擊該鏈接之前請三思！