CoPhish Alert: OAuth Token Phishing Attack in Microsoft Teams/OneDrive (via Copilot Studio links)

This attack poses a high risk of account compromise by leveraging legitimate-looking Microsoft Copilot Studio links. Attackers trick users into consenting to malicious OAuth token theft, granting unauthorized access to their Microsoft services like Teams and OneDrive.

Imagine a clever thief sending you a fancy, official-looking invitation to a party (the legitimate Copilot Studio link). When you click 'RSVP' (consent), you're not just confirming attendance; you're unknowingly signing an invisible agreement that gives them the keys to your house (your OAuth tokens). This allows the thief to come and go as they please, accessing your private rooms (Teams, OneDrive) without needing to pick individual locks.