Microsoft Warns Advertisers of New OAuth Consent Phishing Threat Targeting Users

REDMOND, WA – Microsoft has issued a new security alert to users of its Microsoft Advertising platform, warning of a wave of OAuth consent phishing attacks – a sophisticated form of credential theft designed to look completely legitimate.

In its notice, Microsoft explained that malicious actors are sending out fake login or permission prompts that appear identical to the company’s official consent screens. Once a user clicks “Accept”, the attacker gains access to sensitive advertising data and potentially billing or campaign credentials – all without needing to steal a password.

What is OAuth Consent Phishing?
OAuth consent phishing is a social engineering tactic where hackers register applications that impersonate trusted services, often using similar names, branding, or logos. When users are prompted to “grant permissions,” they unknowingly authorize these malicious apps to access corporate email, data, or advertising accounts through the OAuth system – a common protocol used by platforms like Google, Facebook, and Microsoft for secure sign-ins and app connections.

Unlike traditional phishing that relies on fake websites to collect passwords, OAuth-based attacks are harder to detect because the permissions are granted through legitimate Microsoft channels.

Microsoft’s Recommendations:
The company urges advertisers and marketing teams to:

• Visit myapps.microsoft.com to review and revoke access to any unfamiliar or untrusted apps.
• Change Microsoft Advertising passwords and enable two-factor authentication.
• Report any suspicious consent screens or unauthorized access attempts to their internal IT teams or Microsoft Advertising Support.

Microsoft also provided further guidance on prevention in its Community Hub post “OAuth Consent Phishing Explained and Prevented.”

Why It Matters for Advertisers
For agencies and digital marketers managing multiple advertising accounts, OAuth consent phishing represents a growing threat to campaign integrity and client data. Unauthorized access could lead to hijacked campaigns, fraudulent spending, or exposure of sensitive business information. As the ad industry continues to rely on interconnected APIs and automated platforms, attackers are exploiting the very systems designed for convenience.

Security experts warn that such attacks will likely rise as cybercriminals seek to exploit OAuth’s trust-based design across not just Microsoft but also Google Ads and Facebook’s business tools.

Microsoft Advertising users should immediately review their connected apps and permissions. Any unfamiliar service requesting access should be considered a potential risk.

Vigilance and basic credential hygiene – including MFA and periodic app audits – remain the best defenses.

John Colascione

About The Author: John Colascione is Chief Executive Officer of Internet Marketing Services Inc. He specializes in Website Monetization, is a Google AdWords Certified Professional, authored a ‘how to’ book called ”Mastering Your Website‘, and is a key player in several Internet related businesses through his search engine strategy brand Searchen Networks®