Would You Click ‘Accept’? Automatically detecting malicious Azure OAuth applications using LLMs

This report documents multiple coordinated campaigns (including a large 2025 campaign and legacy 2019 homoglyph campaigns) in which attackers register malicious OAuth applications to trick users into granting consent in Microsoft Entra ID, creating persistent service principals that bypass MFA and enable long-term access to mail and files; the authors describe an automated detection pipeline ("OAuth Apps Scout"), enumerate TTPs and IOCs, and provide actionable defenses such as restricting user consent, auditing OAuth grants, and monitoring first-time applications.