Cybercriminals continue to evolve beyond traditional phishing techniques, leveraging identity-based attacks that bypass even advanced security controls. A recent campaign analyzed by Censys highlights a sophisticated operation dubbed “Oluomo”, which abuses Microsoft OAuth workflows and adversary-in-the-middle (AiTM) phishing techniques. The campaign demonstrates how attackers blend social engineering with modern authentication abuse to compromise enterprise accounts at scale.

*The Certificate of Naturalization lure in Adobe phishing context*, Source : Censys

Understanding the Core Attack: AiTM Meets OAuth Abuse

At its core, the Oluomo campaign combines OAuth application abuse with AiTM phishing infrastructure. Unlike traditional phishing that simply steals credentials, AiTM attacks intercept authentication sessions in real time—allowing attackers to capture session cookies and bypass multi-factor authentication (MFA).

Research into similar campaigns shows that attackers increasingly rely on OAuth as an entry point. Malicious apps impersonate legitimate services and request minimal permissions, acting as a gateway to deeper compromise.

*The Certificate of Naturalization lure in the generic Secure Document Portal context*, Source : Censys

The Oluomo attackers followed a similar blueprint:

Victims receive a convincing lure email
They are redirected to a malicious OAuth consent page
A backend AiTM proxy captures credentials and session tokens
Attackers gain persistent access to Microsoft 365 environments

This shift toward session hijacking rather than password theft reflects a broader trend in identity-centric attacks.

The Social Engineering Hook: Naturalization Form Lure

What sets this campaign apart is its highly targeted lure—a fraudulent “naturalization form.” This theme is particularly effective because it:

Exploits urgency and legal anxiety
Mimics legitimate government documentation workflows
Encourages victims to trust linked documents

Phishing research consistently shows that emotionally charged or authority-based lures significantly increase success rates.

By pairing this lure with Microsoft-branded authentication flows, attackers dramatically increase credibility. Victims often assume they are interacting with a legitimate enterprise system rather than a malicious proxy.

Attack Chain Breakdown

The Oluomo campaign follows a multi-stage attack lifecycle:

1. Initial Access via Phishing Email

The attacker sends emails containing links to what appears to be a legitimate document or form. These links often leverage trusted platforms or convincing domains to evade detection.

2. OAuth Consent Screen Manipulation

Victims are presented with a Microsoft OAuth permission screen requesting access to basic profile data. Even limited permissions can facilitate further attack stages.

3. AiTM Credential Interception

Behind the scenes, an AiTM framework proxies the authentication session. This allows attackers to capture:

User credentials
MFA tokens
Session cookies

This technique effectively bypasses MFA protections.

4. Account Takeover and Persistence

Once access is gained, attackers establish persistence through:

Session reuse
MFA manipulation
OAuth token abuse

5. Lateral Movement and Expansion

Compromised accounts are then used to:

Send additional phishing emails internally and externally
Expand the attack surface across organizations
Conduct business email compromise (BEC) activities

This mirrors patterns seen in large-scale campaigns where compromised identities are weaponized for further attacks.

Why OAuth-Based Attacks Are So Dangerous

OAuth is designed to simplify authentication and enable seamless integrations between services. However, its trust-based model creates opportunities for abuse.

Key risks include:

User trust in Microsoft-branded interfaces
Difficulty detecting malicious OAuth apps
Limited visibility into token misuse
Persistence without passwords

Unlike password-based attacks, revoking access is more complex. Simply resetting credentials is often insufficient because attackers may retain valid session tokens.

Detection Challenges and Security Gaps

Traditional security tools struggle to detect these attacks because:

The login flow appears legitimate
MFA is technically “successful”
OAuth permissions may seem harmless
Traffic is routed through trusted services

Additionally, malicious URLs are often short-lived or dynamically generated, making blacklist-based detection ineffective.

This highlights a fundamental gap: security systems are still largely built around password compromise, not identity session abuse.

Mitigation Strategies for Organizations

To defend against campaigns like Oluomo, organizations must adopt a layered identity security approach:

1. Strengthen OAuth Governance

Restrict third-party app consent
Require admin approval for OAuth applications
Regularly audit connected apps

2. Implement Conditional Access Policies

Evaluate login context (location, device, risk signals)
Block suspicious authentication attempts

3. Monitor Session Behavior

Detect anomalous session activity
Revoke active sessions during incident response

4. Enhance User Awareness

Train users to recognize OAuth consent phishing
Emphasize caution with document-based lures

5. Deploy Advanced Threat Detection

Use tools capable of identifying AiTM patterns
Monitor for abnormal token usage and sign-in anomalies

The Bigger Picture: Identity Is the New Perimeter

The Oluomo campaign reinforces a critical reality: identity systems have become the primary attack surface. As organizations migrate to cloud-first environments, attackers are shifting focus from endpoints to authentication flows.

Modern phishing is no longer about tricking users into entering passwords—it’s about exploiting trust in identity infrastructure.

Our Opinion on the Oluomo Campaign

The Oluomo campaign is a clear signal that cybersecurity has entered a new phase—one where identity abuse, not malware, is the dominant threat vector. What makes this attack particularly concerning is not just its technical sophistication, but its strategic design. By combining OAuth abuse with AiTM interception and a psychologically compelling lure, attackers are effectively bypassing both human and technical defenses.

In our view, the biggest issue exposed by this campaign is the over-reliance on MFA as a silver bullet. While MFA remains essential, attackers have adapted quickly, using session hijacking techniques that render it ineffective in isolation. This creates a dangerous false sense of security within organizations.

Another critical takeaway is the lack of visibility into OAuth ecosystems. Many organizations do not fully understand which applications have access to their environments, creating blind spots that attackers exploit.

Going forward, security strategies must shift toward continuous authentication and behavioral monitoring, rather than one-time verification. Zero Trust principles—especially around identity and session validation—are no longer optional.

Ultimately, the Oluomo campaign is not just another phishing attack; it is a blueprint for the future of cybercrime. Organizations that fail to adapt will find themselves increasingly vulnerable in an identity-driven threat landscape.

Oluomo Phishing Campaign Exploits Microsoft OAuth Flows, Bypasses MFA with Advanced AiTM Tactics