Know What's Happening in SaaS

Phishing and OAuth Token Vulnerabilities Lead to Full Microsoft 365 Breach

Researchers identified two medium‑severity flaws—a publicly accessible email API endpoint and verbose error handling that discloses OAuth tokens—that can be combined to launch authenticated phishing campaigns inside Microsoft 365 tenants. By exploiting the open relay, attackers send messages that appear to originate from legitimate internal services, bypassing SPF, DKIM and DMARC. Extracted Graph API tokens then provide read/write access to directories, Teams, and SharePoint, enabling data theft and persistent control. The chain illustrates how modest bugs can culminate in a full‑scale tenant breach.