A new phishing technique dubbed 'CoPhish' weaponizes Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests via legitimate and trusted Microsoft domains. The technique was ...

Oauth2 on Azure Entra ID demonstrated with client and server FastAPI applications in Python. The server is deployed to Azure Web Apps via a GitHub Actions Workflow script. Client utilizes OIDC with ...

Tl;dr: If you manage even one Microsoft 365 tenant, it’s time to audit your OAuth apps. Statistically speaking, there’s a strong chance a malicious app is lurking in your environment. Seriously, go ...