A phishing campaign tracked by Check Point didn’t bother faking a Microsoft login page. It sent people to the real one, then asked them to approve an attacker-controlled app. From June 25 through the second week of July, Check Point’s email researchers found more than 200 of these emails aimed at about 120 organizations across many industries and countries.
The messages posed as Microsoft Planner task notifications under the sender name “There’s New Activity On Team,” with subject lines claiming an HR address had sent three Teams messages. The body mimicked Teams styling, mentioned a “Payroll, Compensation + Benefits Update” and showed “4 Overdue Employee Tasks” to push a quick click. The visible sender address belonged to the target’s own organization, so the email appeared to come from the recipient, and every link went through the same redirect.
A real sign-in, then a permissions prompt
The link opened a legitimate login.microsoftonline.com OAuth authorization URL. After signing in, the victim saw a prompt to “Approve permissions” or “Accept on behalf of your organization.” Approving sent the authorization code to an AWS API Gateway endpoint run by the attackers, who exchanged it for access. Depending on what was approved, the app could read, search and send mail, open files, and reach Teams chats, SharePoint, OneDrive and calendars. Check Point warned that a hijacked mailbox is a common springboard for business email compromise from a trusted internal address.
“Attackers have stopped forging Microsoft’s front door and started walking through it. Every screen the victim sees is authentic, the only fake thing in this entire chain is the intent behind the app requesting access,” Check Point said. Industrial and manufacturing firms received the most emails, followed by legal and professional services, nonprofits, government and healthcare. The campaign is no longer active, and Infosecurity Magazine also covered the findings.
Check Point says consent phishing is a named technique in the MITRE ATT&CK framework and that in 2026 it became a service almost anyone can rent. Its advice for employees: hover over links and be wary when different buttons lead to the same URL, check that the sender name, address and domain match, don’t trust a message just because it looks internal, open Teams directly instead of through email links, and report suspicious messages quickly so security teams can revoke a malicious consent. Administrators can also limit which apps users are allowed to approve on their own in Microsoft Entra ID.
WebProNews is an iEntry Publication