The OAuth Phishing Trap: Proofpoint Exposes AiTM Attacks That Bypass MFA to Hijack Cloud Accounts

Proofpoint details widespread AiTM OAuth phishing campaigns that abuse maliciously registered Azure OAuth applications and the Tycoon PhaaS to proxy Microsoft 365 login flows, harvest credentials and MFA/session tokens, and achieve account takeovers; telemetry shows ~3,000 attempted compromises across ~900 tenants with a >50% observed success rate, and recommended defenses include blocking impersonation emails, detecting malicious OAuth apps, web isolation, user training, and adoption of phishing-resistant FIDO keys.