Phishing and OAuth Token Flaws Lead to Full Microsoft 365 Compromise

The report details an attack chain where attackers manipulate public API inputs to force an organization’s own systems to send malicious, legitimately-originating emails that bypass authentication checks, and trigger verbose error responses that expose OAuth/JWT tokens; harvested tokens grant authenticated access to Microsoft Graph resources (SharePoint, Teams, Outlook) and can enable data exfiltration and Azure pivoting. It recommends strict input validation and disabling verbose debug errors in production to prevent token leakage.