Money-grubbing crooks abuse OAuth – and baffling absence of MFA – to do financial crimes

Microsoft warns that criminals are abusing OAuth 2.0 by using compromised accounts to create malicious OAuth applications and grant them permissions, enabling large-scale spam campaigns, phishing (including token-stealing proxies), BEC reconnaissance, and deployment of Azure VMs for illicit crypto-mining that has resulted in significant cloud costs; Microsoft recommends enforcing MFA, conditional access, continuous access evaluation, monitoring VM creation and app-consent activity, and provides incident response playbooks.