Weekly Threat Intel: OAuth App Abuse, Autumn 2026 CVE Exploitation, and Malware Loader Trends

Reissued 27 September 2026. The CVE watchlist originally published in this issue named products that could not be verified and cited identifiers that do not match NVD records. The watchlist below has been rebuilt from the CISA KEV catalog’s actual additions for 21–25 September 2026.

TL;DR: This Week’s Threats in One Look

OAuth third-party app abuse is this week’s dominant initial-access and persistence vector, targeting Microsoft 365 tenants through phishing consent grants and long-lived refresh tokens; loader families are consolidating onto shared infrastructure; and your immediate priorities are tenant consent lockdown, aggressive patch SLAs on internet-facing CVEs, and egress filtering to break loader C2.

Campaign Spotlight: OAuth App Abuse Techniques

Traditional phishing steals credentials. OAuth abuse doesn’t need them—attackers abuse the authorization framework itself, and that distinction changes your entire detection posture.

The pattern this week follows three techniques:

• Consent phishing. Attackers register a legitimate-looking multitenant app in their own Azure tenant—named to mimic “Microsoft Office 365” or an internal SSO portal—and send victims a crafted authorization URL. One click on “Accept” hands the attacker a long-lived refresh token. No password entry, no MFA prompt, nothing for your conditional access policies to catch at authentication time. The end-state is the same one Microsoft’s Storm-2372 device code phishing campaigns of early 2025 demonstrated — attacker-held, long-lived tokens that survive authentication events; illicit OAuth consent grants are an older cousin Microsoft has documented for years. OWASP’s API Security guidance and the OAuth 2.0 threat model (RFC 6819) both flag illicit grant flows as a first-class risk.
• Compromised third-party apps. Any app already consented into your tenant is a standing privilege. When a vendor’s app registration or its backing infrastructure is compromised, the attacker inherits your tenant’s trust—Mail.Read, Files.ReadWrite, whatever your users granted years ago and forgot.
• Refresh token persistence. Refresh tokens for first-party resources (Office 365, Graph API) can remain valid for up to 90 days with continuous use, and often survive password resets and MFA re-enrollment unless explicitly revoked. The attacker doesn’t need the user again—they need the token.

You’re not defending a perimeter here—you’re defending a delegation graph. For a deeper dive on identity-token tradecraft, see our guide to token theft and session hijacking.

Defender Actions: Detecting and Revoking Malicious OAuth Grants

This is hands-on work. Do it today, not next sprint.

1. Lock down consent policy

Set user consent to “Do not allow user consent” for unverified apps, or at minimum restrict it to apps from verified publishers with low-impact permissions. Enable the admin consent workflow so legitimate requests route to approvers instead of users. Verify this in Entra ID: Enterprise applications → Consent and permissions.

2. Hunt for suspicious consent events

Query the Entra ID audit logs for consent grants in the last 14 days:

// Microsoft Graph PowerShell: recent consent grants
Get-MgAuditLogDirectoryAudit |
  Where-Object { $_.ActivityDisplayName -eq "Consent to application" } |
  Select-Object ActivityDateTime, @{n="Actor";e={$_.InitiatedBy.user.userPrincipalName}},
                @{n="App";e={$_.TargetResources[0].DisplayName}},
                @{n="AppId";e={$_.TargetResources[0].Id}} |
  Sort-Object ActivityDateTime -Descending

In KQL against Entra ID audit logs in Microsoft Sentinel:

AuditLogs
| where ActivityDisplayName == "Consent to application"
| where TimeGenerated > ago(14d)
| extend App = tostring(TargetResources[0].DisplayName)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend Scope = tostring(parse_json(tostring(AdditionalDetails))[0].value)
| project TimeGenerated, Actor, App, ResultDescription

Red flags: apps added by non-admins, multitenant apps with unknown publisher domains, and consent scopes including Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, or AppRoleAssignment.ReadWrite.All.

3. Revoke and remediate

• Remove the service principal: Remove-MgServicePrincipal -ServicePrincipalId <objectId>
• Revoke all refresh tokens for affected users: Revoke-MgUserSignInSession -UserId <user> — a password reset alone does not kill the token.
• Review mailbox audit logs for suspicious MailItemsAccessed and New-InboxRule events for token-bearing accounts.

Autumn 2026 CVE Exploitation: What’s Being Hit Right Now

This week’s active-exploitation set clusters around three product families, consistent with a pattern we’ve tracked all Autumn: edge devices and enterprise middleware get exploited within days of proof-of-concept release, while endpoint software exploitation lags. Current KEV-tracked activity (verify live at CISA’s Known Exploited Vulnerabilities Catalog) includes:

• CVE-2026-5430 — WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway: path traversal leading to unrestricted file upload and remote code execution (KEV added 24 September).
• CVE-2026-71362 — Adobe Commerce / Magento: incorrect authorization allowing elevated access to sensitive resources with no user interaction (KEV added 24 September).
• CVE-2026-67279 — MikroTik RouterOS: unauthenticated session channel with exec request, chainable for device takeover — internet-exposed routers first (KEV added 25 September).
• CVE-2026-65660 — Microsoft SharePoint: code injection by an authorized attacker over the network; check your farm patch level before the weekend (KEV added 25 September).
• CVE-2026-87902 — WordPress Core: unauthenticated remote file inclusion via page-template resolution — patch managed-hosting and legacy self-hosted blogs alike (KEV added 25 September).
• The edge-appliance wave (Zyxel GS1900, Arista VeloCloud, F5 BIG-IP APM, Check Point) was covered in Monday’s issue and remains the top patch priority.

The common thread: none of these require user interaction, all are remotely exploitable, and all have public exploit code. That combination should drive your patch triage, which we cover next.

Patch Prioritization: Mapping Exploited CVEs to Defender SLAs

Stop patching by CVSS score alone. Triage by exposure × exploit maturity:

Inventory queries to find your exposure fast:

// Sentinel: devices missing a KB (example)
DeviceTvmSoftwareVulnerabilities
| where VulnerabilityId in ("CVE-2026-5430","CVE-2026-71362","CVE-2026-67279","CVE-2026-65660","CVE-2026-87902")
| join kind=inner DeviceInfo on DeviceId
| where IsInternetFacing == true
| project DeviceName, VulnerabilityId, OSPlatform, PublicIP

Cross-reference every finding against the KEV catalog (CISA provides a machine-readable feed) and your external attack surface. For teams building this into Zero Trust segmentation, our Zero Trust implementation guide covers exposure-based policy mapping.

Malware Loader Trends: Consolidation and Delivery Patterns

The loader ecosystem is consolidating. Fewer families—each sold as malware-as-a-service—are delivering a wider range of second-stage payloads, and infrastructure overlap between ostensibly distinct “families” is now the norm rather than the exception. This week’s observations:

• Delivery channels: Phishing with HTML attachment-smuggling and heavily obfuscated JavaScript remains the workhorse. Malvertising against branded software search terms has surged—search-engine results for common enterprise tools are a reliable initial access vector. SEO poisoning continues to push trojanized installers for legitimate utilities to the top of results for niche IT keywords.
• Execution chains: LOLBin abuse dominates post-delivery execution: mshta.exe, wscript.exe, and curl.exe retrieving staged payloads; Windows Installer MSI loaders abusing custom actions; and DLL side-loading via legitimately signed utilities.
• Persistence: Scheduled tasks and registry Run keys remain standard; we’re also seeing loader families abusing COM object hijacking for lower-friction persistence.
• Infrastructure: Shared bulletproof hosting, overlapping fast-flux resolver networks, and reuse of the same blocked-asymmetric routing assets across multiple loader brands. The practical takeaway: block and hunt on infrastructure indicators, not family names.

Hands-On Detection: Hunting Loader Activity

Loader tradecraft is noisy if you know where to listen. Three detection patterns:

YARA — office document dropping obfuscated script

rule Loader_Obfuscated_JS_Dropper {
  strings:
    $js1 = /ActiveXObject\s*\(\s*["']MSXML2.ServerXMLHTTP["']/ ascii
    $js2 = /WScript.Shell/ ascii
    $obf = /\x[0-9a-f]{2}(\x[0-9a-f]{2}){10,}/ ascii
  condition:
    uint16(0) == 0x4F5C and (all of ($js*) or $obf)
}

Sigma — LOLBin chain via scheduled task persistence

title: Suspicious Scheduled Task Created by Script Host
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4698
    TaskContent|contains:
      - 'mshta.exe'
      - 'wscript.exe'
      - 'rundll32.exe'
      - 'curl.exe'
  condition: selection
level: high

KQL — C2 beacon periodicity

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("mshta.exe","rundll32.exe","curl.exe","regsvr32.exe")
| summarize count(), bins=dcount(bin(Timestamp, 1m)) by DeviceName, RemoteUrl
| where bins > 30
| project DeviceName, RemoteUrl, count_

Pair these with egress filtering—default-deny outbound on servers and blocking of newly registered domains—to break the C2 callback even when execution succeeds. See our full malware loader tradecraft guide for deeper emulation detail.

Tradecraft-to-Defense Mapping Table

CTF and Lab Corner: Practicing This Week’s Patterns

Skills decay without practice. Two exercises, both safe if isolated:

• OAuth consent-phishing lab: Stand up a free Microsoft 365 developer tenant and register a multitenant app in a separate tenant. Send yourself a consent URL and walk the full flow—observe exactly what the consent screen shows, what the audit log records, and what the refresh token can access using Microsoft’s documented authorization code flow. Then test your own detection queries against it. Everything stays inside your isolated dev tenants.
• Loader emulation: In an isolated VM (no production network, host-only), create a signed-looking phishing chain: an HTA file spawning a scheduled task that calls curl.exe against a local listener (a simple Python HTTP server suffices as the “C2”). Verify your Sigma rule fires, your egress policy blocks the callback, and your YARA rule matches the sample. Never reuse live malware in shared environments—emulate the behaviors, not the binaries.

Weekly Risk Radar and Sources

Confidence: High confidence on OAuth abuse techniques and loader delivery patterns (multiple corroborating vendor reports and observed infrastructure overlap). Moderate confidence on specific Autumn 2026 CVE targeting volumes—exploitation counts lag real-world activity by days. Watch next week: escalation of edge-device exploitation chains into identity provider compromise, and whether the loader consolidation produces a single dominant delivery-as-a-service brand.

• CISA Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK Framework
• OWASP Top Ten
• Microsoft Entra ID consent policy documentation
• Graph API: revoke user sign-in sessions

Frequently Asked Questions

How do I find malicious OAuth app consents in my tenant?

Review Entra ID → Enterprise applications and the audit logs for “Consent to application” events. A quick Graph PowerShell query surfaces new grants:

Get-MgAuditLogDirectoryAudit |
  Where-Object { $_.ActivityDisplayName -eq "Consent to application" } |
  Select-Object ActivityDateTime,
    @{n="Actor";e={$_.InitiatedBy.user.userPrincipalName}},
    @{n="App";e={$_.TargetResources[0].DisplayName}}

Triage by publisher verification status, requested scopes, and whether the consenting user had a legitimate reason to see the app.

What’s the fastest way to block OAuth app abuse?

Three moves: disable user consent for unverified apps, enforce the admin consent workflow for everything else, and revoke suspicious refresh tokens with Revoke-MgUserSignInSession. Those three together break the access-grant, escalation, and persistence legs of the attack chain.

Which Autumn 2026 CVEs should I patch first?

Start with anything KEV-listed and internet-facing—that’s your Tier 0, with a 24–72 hour SLA. The triage is simple: exploit maturity (KEV or public PoC) multiplied by exposure (internet-facing vs. internal). CVSS is a tiebreaker, not a driver.

How do malware loaders typically get in this week?

Phishing attachments with obfuscated JavaScript, malvertising on software search terms, and SEO-poisoned trojanized installers—followed by LOLBin execution chains (mshta, wscript, curl) and scheduled-task persistence. The delivery brands change weekly; the behavior chain barely does.

Are these detection queries safe to run in production?

Yes. All log queries in this article are read-only against audit and telemetry data—they impose no risk beyond query cost. Emulation labs, however, must stay fully isolated from production networks; simulate loader behaviors only on air-gapped or host-only VMs.