MICROSOFT WARNS OF OAUTH APPS BEING USED TO AUTOMATE BEC AND CRYPTOMINING

Summary from the TLDR InfoSec newsletter

Microsoft Threat Intel experts have been investigating a new post-exploitation technique in which attackers use compromised accounts to create high-privileged OAuth apps. These OAuth apps allow attackers to spawn VMs for cryptomining, automate BEC attacks, and manage spam campaigns without needing to retain access to the original compromised account. Microsoft recommends enforcing MFA and conditional access policies to protect against attacks like this.