The Invisible Backdoor: AI Exposes Malicious OAuth Apps Hiding in Microsoft Entra ID

The integration of third-party applications into corporate environments has become the lifeblood of modern productivity, but it has also created a sprawling, often unmonitored attack surface. According to a newly published report by Wiz Research, threat actors are increasingly exploiting this blind spot, transforming mundane app permissions into silent, persistent backdoors.

The threat centers around Microsoft Entra ID (formerly Azure AD). The report warns that “OAuth applications in Microsoft Entra ID are a common persistence and privilege escalation mechanism used by attackers”. Because these applications are “frequently created, modified, and forgotten, malicious applications often blend in with legitimate business integrations”.

To combat this stealthy threat, Wiz researchers decided to fight fire with artificial intelligence.

“By analyzing known OAuth attack campaigns across multiple environments, we developed OAuth Apps Scout – a proactive detection pipeline that automatically surfaces emerging malicious OAuth applications,” the report states. This LLM-powered scout has already successfully identified malicious apps across dozens of compromised organizations.

The tool’s deep dive into historical data revealed a fascinating evolution in how cybercriminals deceive users into granting access.

Looking back at legacy campaigns, attackers relied heavily on visual trickery to impersonate core Microsoft services. Wiz’s AI uncovered seven previously undetected malicious applications dating back to 2019 that used a clever linguistic ruse.

“These apps utilized Cyrillic homoglyphs, replacing Latin characters with visually identical non-Latin letters, to mimic legitimate Microsoft services,” the researchers discovered.

These visually deceptive applications included:

• OneDrive for Business (Uses Cyrillic “п”)
• Sharepoint Cloud (Uses Cyrillic “о”)
• Microsoft Cloud App Security (Uses Cyrillic “г”)

These seemingly obvious, yet highly effective, homoglyph apps were found actively embedded across more than 50 organizations, “highlighting a long-term gap in traditional detection methods”.

However, the cybercriminal playbook has undergone a radical transformation in 2025. Recognizing that security tools and users have become hyper-vigilant about fake Microsoft prompts, threat actors have pivoted to the broader ecosystem.

“Attackers have moved away from spoofing Microsoft itself and are now leveraging the trust of third-party productivity tools like Adobe and DocuSign,” the Wiz report reveals.

Instead of naming an app “SharePoint Cloud,” a modern attacker will name it “DocuSign” and route the reply URL through seemingly legitimate infrastructure, completely bypassing rudimentary keyword filters.

“The modern attacker is significantly stealthier,” the report concludes. “They have traded ‘obvious’ typosquatting for sophisticated URL structures and legitimate-looking SaaS platforms to host their redirect points”.

As attackers refine their disguises, security teams can no longer rely on static blocklists or simple typo-catchers. The deployment of AI-driven tools like OAuth Apps Scout represents the next necessary step in securing the identity perimeter against a highly adaptable enemy.

Related Posts:

• Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT
• Socket Uncovers Malicious NuGet Typosquat “Netherеum.All” Exfiltrating Wallet Keys via Solana-Themed C2
• Microsoft Warns: Threat Actors Turn Microsoft Teams into a Weapon for Ransomware, Espionage, and Social Engineering
• Malicious Firefox Extensions Unmasked: Fake Games, VPNs, & Calendar Tools Hijack Traffic, Steal Crypto & OAuth Tokens