huntress.comwriteup

6 Months of Researching OAuth Application Attacks | Huntress

Huntress details six months of research into malicious Azure/Entra ID OAuth applications, splitting them into "Traitorware" (legitimate-looking apps commonly abused by attackers, ~10% of surveyed tenants had at least one) and "Stealthware" (custom-built OAuth Illicit Consent Grant apps used for persistence and data theft). Drawing on enumeration of 8,000+ tenants and Huntress partner telemetry, the SOC found over 500 confirmed Stealthware instances and identifies detection heuristics (low global app prevalence + single-user delegation + powerful permission scopes). The post also announces Cazadora, an open-source script that authenticates via Graph API to hunt rogue Enterprise Applications and App Registrations for known malicious naming patterns and reply URLs.