Another Office 365 OAuth Attack Targets Coinbase Users to Gain Compromised Email Access

OAuth Attack Office 365The latest attack attempts to trick Office 365 users that use Coinbase into giving access to their mailbox via a Consent app rather than trying to steal their credentials.

With over 35 million users, Coinbase users are a pretty sizable target audience. At least that’s what the bad guys are betting on. And, from what we see in this latest attack, they’re also betting that Coinbase users are using Office 365.

In the latest attack, users receive an email impersonating Coinbase asking users to update their terms of service. Upon clicking the link to review the new ToS, users are taken to a legitimate Office 365 logon page (no funny stuff at this point in the attack), and are then presented with a request for access the user’s mailbox and information, citing “” as the requestor (to keep with the ruse that this is about updating Coinbase terms of service).

10-8-20 Image
Credit: Bleeping Computer

Once access is granted, the app now has access to read the victim’s emails, delete messages, and more. The only way to remove access is administratively.

This kind of attack isn’t new but is instead gaining ground. We’ve seen Consent app-based attacks since the beginning of this year. Our own Data-Driven Defense Evangelist, Roger Grimes has even written a detailed article on how Consent app attacks work and what to do about it.

Users need to be educated via Security Awareness Training that they should be looking for these kinds of attacks and only grant access to legitimate app publishers (such as Outlook for mobile devices).

Find out which of your users' emails are exposed before bad actors do.

Many of the email addresses and identities of your organization are exposed on the internet and easy to find for cybercriminals. With that email attack surface, they can launch social engineering, spear phishing and ransomware attacks on your organization. KnowBe4's Email Exposure Check Pro (EEC) identifies the at-risk users in your organization by crawling business social media information and now thousands of breach databases.

EECPro-1Here's how it works:

  • The first stage does deep web searches to find any publicly available organizational data
  • The second stage finds any users that have had their account information exposed in any of several thousand breaches
  • You will get a summary report PDF as well as a link to the full detailed report
  • Results in minutes!

Get Your Free Report

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Email Security

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews