# Would You Click ‘Accept’? Automatically detecting malicious Azure OAuth applications using LLMs

Malicious Entra ID OAuth apps impersonating Adobe/DocuSign/Microsoft via homoglyphs and fake consent prompts gained persistent mail/file access across 20+ orgs.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Wiz Research
- Disclosed: 2026-02-18
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/detecting-malicious-oauth-applications
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-detecting-malicious-oauth-applications
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:recon technique:unicode-normalization vuln:account-takeover vuln:auth-bypass

**Target:** Azure/Microsoft Entra ID OAuth applications and consent flow
**Root cause:** Users grant OAuth consent to attacker-registered multi-tenant apps with spoofed names/logos; the resulting service principal persists independently of user credentials, surviving password resets and MFA.
**Steps:**
1. Attacker registers multi-tenant app in own tenant with brand-impersonating name (e.g. `Adobe`, or Cyrillic homoglyph `ОпeDrive for Business`) and logo
2. Configure redirect URI to attacker infra, e.g. `https://topboysteamworkspace.myclickfunnels.com/sahreddocumentfile` or `https://fancy-bush-61e9sydgsyi29s.jennifer-may.workers.dev/`
3. Request high-risk delegated scopes such as `Mail.Read`, `Files.ReadWrite.All`
4. Phish user to Microsoft sign-in page with app consent link
5. User clicks Accept; Entra creates service principal in victim tenant and redirects token to attacker redirect URI
6. Attacker uses token to read mail/files; access persists via service principal until grant removed
**How found:** Manual review of a homoglyph app (zero vs letter O) led to comparing malicious vs legitimate DocuSign app metadata: unverified publisher, missing homepage, unrelated/free-hosting reply URL, mismatched owner domain, low tenant prevalence. These weak signals were operationalized into a weighted-scoring pipeline plus LLM contextual evaluation.
**Exploitation:** Phishing lure directs victim to genuine Microsoft login; after authentication the consent prompt is accepted, and the authorization code/token is delivered to the attacker's redirect URL hosted on free SaaS (ClickFunnels, Cloudflare Workers, beehiiv). Attacker then reads email and files via delegated permissions without triggering MFA or anomalous-login alerts.
**Escalation:** Pivoting on shared reply URLs, owner tenant domains and naming conventions clustered 19 apps into one campaign and surfaced 7 legacy homoglyph apps across 50+ orgs.
**Insight:** Low-prevalence OAuth apps consented by only 1-2 users, with reply URLs on shared SaaS hosts (ClickFunnels, workers.dev, beehiiv) and unverified publishers, are strong malicious-consent indicators; homoglyph app names (Cyrillic п/г/ѕ) evade string matching, so normalize Unicode before comparing to known brand names.