Creating a Malicious Azure AD OAuth2 Application

This blog post is a step-by-step malicious playbook for building and operating a malicious OAuth web application that abuses Azure AD and Microsoft Graph to phish users, enumerate organization users, and exfiltrate mailbox contents. It covers LAMP server setup, deploying CoasterKaty's PHPAzureADoAuth code, database/configuration changes, registering Azure AD apps (including creating client secrets and configuring scopes), handling unverified vs verified publisher constraints, adding Graph API calls to harvest users and emails, persisting stolen data to disk, and an insider-compromise variant that targets only an organization’s tenant to gain broader access.