Extortion via OAuth Application

October 8, 2026Katarina Zotovic · DFIR Lead

Most extortion cases target critical hosts: servers are encrypted, endpoints are locked and backups are targeted. We recently worked on an extortion case that ran entirely in the cloud, with no compromised user, no endpoint touched, and no encryptor.

The attacker stole the client secret of an OAuth application (in effect, the password an app uses to sign itself into the cloud environment) and used the app’s own permissions to take data, read mail, delete files and leave ransom notes. Many compromises still begin with a phished user, but we’re seeing attackers increasingly go after application secrets as an alternative.

The attack chain

Once the attacker stole the automation app’s secret, they authenticated as the app itself to get into the tenant, with no user account takeover required. They presented the app ID and secret to Entra ID, and got back an access token carrying the app’s application permissions. From that point on, everything they did went through legitimate APIs alongside legitimate Microsoft 365 infrastructure, making it more difficult to detect and differentiate.

Attack chain diagram: a stolen client secret for an automation OAuth app leads to an app-only sign-in via PowerShell and Azure CLI with no user, then tenant-wide Graph and SharePoint API access, which the attacker used to exfiltrate files, read mail across dozens of mailboxes, leave ransom notes and delete files. User MFA, Conditional Access and user risk alerts were never challenged.

Due to the way the attacker gained access to the environment, they bypassed controls that most tenants rely on: MFA, conditional access, and risk detectors. We did see, however, that the attacker tried the user route too, with failed sign-ins against several user accounts. But they didn’t require those to succeed in their aims.

With the stolen token, the attacker used ordinary Microsoft Graph and SharePoint APIs to:

exfiltrate SharePoint data in bulk
access emails and attachments across dozens of mailboxes
delete files after the data had been taken
drop ransom notes in waves across sites used by both standard users and admins

Extortion play

The ransom notes were plain text files that set payment deadlines. With no encryptor, the attacker’s leverage was the data they had already stolen and the clock they had put on the decision to pay. They also made sure the notes, and the demands they held, wouldn’t be missed; alongside the notes in user-facing sides, they uploaded the text files to the tenant App Catalog as if they were SharePoint apps. Though SharePoint rejected them as invalid packages, they still appeared in the admin view where any administrator could find them.

Defending against app-only attacks

Treat every app registration with a secret the way you’d treat an admin account:

Know what you have: keep track of which app holds secrets
Limit their permissions: give each app only what it needs
Prefer certificates: rotate any remaining secrets on a defined schedule
Monitor their activity: watch where they sign in from and what they access.

Cloud-only extortion like this moves fast and leaves few traces in the places most security teams look. If you’d like to talk more about this, our team is here to help.