Phishing on Microsoft's real login page: MFA won't save you

The best phishing page in the world is the real one. A campaign documented by Check Point sent targets to the genuine login.microsoftonline.com sign-in screen — no typosquatted domain, no proxy, nothing for a user to spot — and then asked them to click Approve. OAuth consent phishing doesn't steal your password, so multi-factor authentication doesn't stop it.

What actually happened

Check Point's research team tracked more than 200 phishing emails against roughly 120 organizations between June 25 and mid-July 2026, with 98.3% of targets in North America. The lure was a fake Microsoft Teams and Planner task notification — "Payroll, Compensation + Benefits Update," an overdue-task counter, and a sender name spoofed so the mail appears to come from the recipient's own address.

The link is a legitimate Microsoft OAuth authorize URL. The user signs in for real, MFA prompt and all, then hits a permissions screen for an attacker-registered application asking for mail, files, Teams, SharePoint, OneDrive, and calendar access. Approve it and Microsoft redirects the authorization code to the app's redirect_uri — in this campaign, an AWS API Gateway endpoint the attacker controls. Microsoft has documented this redirect-abuse pattern itself.

The result is a token, not a password. Rotating credentials doesn't revoke it. Neither does MFA, because the user genuinely authenticated.

Why it matters for your business

Your security awareness training tells people to check the URL. Here the URL is correct. It's Microsoft's. The one anomalous thing on screen is a consent dialog that looks like the fifty other consent dialogs your team has clicked through to connect a scheduling tool or a PDF signer.

This is a configuration problem, not a training problem. In Entra ID, restrict user consent so employees can only approve apps from verified publishers — or turn user consent off entirely and route requests through the admin consent workflow. Then go read your Enterprise Applications list. Most small companies have never opened it, and it is a standing inventory of every third party holding a live token to their mailboxes and files. Revoke what you don't recognize. When something does get approved, revoking the service principal is the containment step; password resets are theater.

We lock down consent policy and audit the app grants nobody's looked at since the day they were made.

Sources: Check Point Research, Microsoft Security Blog.