Microsoft Previews Feature to Block Malicious OAuth Apps

The report explains that attackers are increasingly abusing malicious OAuth apps to gain persistent access to cloud accounts and launch phishing, credential-stuffing, and spam campaigns; Microsoft observed such attacks and Dropbox warned of exposed API/OAuth credentials. In response, Microsoft is previewing Defender XDR capabilities that automatically disable compromised OAuth apps to disrupt these attacks and has added OT/ICS protections and AI-assisted disruption to speed detection and response.