UNC6040: The Vishing-to-OAuth Attack Chain - A Threat Analysis Report By CyberDudeBivash

 

 

By CyberDudeBivash • October 02, 2025, 10:35 AM IST • APT Threat Intelligence Report

 

Multi-Factor Authentication (MFA) is the bedrock of modern identity security, but threat actors are evolving. We are tracking an emerging threat actor, designated **UNC6040**, that is successfully bypassing MFA protections through a sophisticated attack chain that combines old-school social engineering with modern cloud application abuse. This **"Vishing-to-OAuth"** campaign targets corporate users of Microsoft 365. Instead of trying to steal passwords, the attacker's goal is to trick the victim into granting persistent, privileged access to a malicious OAuth application. This technique grants the attacker access to the victim's email and files, completely bypassing the need for passwords or future MFA prompts. This is a deep-dive analysis of the TTPs used by UNC6040 and the critical defenses needed to counter this threat.

 

Disclosure: This is a technical threat intelligence report for SOC analysts, security administrators, and IT leaders. It contains affiliate links to relevant security solutions and training. Your support helps fund our independent research.

 

    Recommended by CyberDudeBivash — The Zero Trust Identity Stack  

 

   
• Kaspersky Security for Microsoft 365 — Add an extra layer of scanning and threat detection inside your M365 environment.
   
• Cybersecurity Awareness Training — The #1 defense against social engineering. Train your users to spot vishing and other manipulation tactics.
 

  Worried About a Cloud Account Takeover?  
Hire CyberDudeBivash for incident response and cloud security assessments.

  Threat Report: Table of Contents  

   
1. Chapter 1: Threat Actor Profile — UNC6040
   
2. Chapter 2: The Kill Chain — From a Phone Call to Full M365 Compromise
   
3. Chapter 3: Technical Deep Dive — The Mechanics of Illicit OAuth Consent
   
4. Chapter 4: The Defender's Playbook — Detecting and Blocking the Attack
   
5. Chapter 5: Strategic Summary & Indicators of Compromise (IOCs)
 

---

Chapter 1: Threat Actor Profile — UNC6040

UNC6040 is a recently designated threat actor cluster characterized by its specialized and highly effective social engineering tactics. Our assessment is that this is a financially motivated group focused on Business Email Compromise (BEC), financial fraud, and data exfiltration for extortion. Their key differentiator is the professional and patient execution of vishing calls, demonstrating a high degree of preparation and research on their targets.

---

Chapter 2: The Kill Chain — From a Phone Call to Full M365 Compromise

The UNC6040 attack chain is a masterclass in modern social engineering.

   
1. **Reconnaissance:** The attacker harvests employee names, job titles, and phone numbers from public sources like LinkedIn and corporate websites.
   
2. **The Vishing Call:** The attacker calls a target employee, impersonating a member of their internal IT helpdesk or Microsoft Support. They use a pretext that creates urgency, such as: "We're responding to a security alert on your account" or "We need to migrate you to a new secure email gateway."
   
3. **The Malicious App Registration:** The attacker directs the user to a specific URL. This page initiates the legitimate Microsoft 365 login process, but it is for the purpose of granting permissions (consent) to a third-party OAuth application that the attacker has registered in Azure AD. This app may have a convincing name like "Microsoft Office Security Sync" or "Company SSO Verifier."
4. **Social Engineering the Consent Grant:** The attacker stays on the phone with the victim, guiding them through the login and MFA steps. When the crucial "Permissions requested" screen appears, the attacker uses their authority to calm the user's suspicion: "Yes, that's our new security tool. Please click 'Accept' to finish syncing your account."
5. **Account Takeover:** The moment the user clicks "Accept," the attack is successful. The attacker's malicious application is granted an OAuth token with permissions like `Mail.ReadWrite`, `Files.ReadWrite.All`, and `offline_access`. The attacker now has persistent, programmatic access to the user's email and files, without ever needing their password again. The MFA has been successfully bypassed.

---

Chapter 3: Technical Deep Dive — The Mechanics of Illicit OAuth Consent

This attack doesn't steal your password; it steals your permission. The OAuth 2.0 consent framework is a legitimate feature used by thousands of apps. When you "Log in with Google" on a new service, you are performing an OAuth consent grant. You are giving that service permission to access parts of your Google account.

Attackers abuse this by registering their own malicious application and requesting dangerous, overly-broad permissions. A user, especially when under pressure from a convincing voice on the phone, may not scrutinize the requested permissions (`Read and write access to all your files`) and simply click 'Accept'. Once consent is granted, the attacker's app has a token that it can use to access your data from their own servers, at any time, until the grant is revoked.

---

Chapter 4: The Defender's Playbook — Detecting and Blocking the Attack

Defense requires a combination of human-layer and technical-layer controls.

Step 1: The Human Firewall — User Training

This is your primary defense. Employees must be trained on vishing tactics:

• **Establish a Verification Protocol:** Train users to NEVER approve MFA prompts or grant permissions based on an unsolicited inbound phone call. The correct procedure is to hang up and call the IT helpdesk back on a known, official company phone number to verify the request.
• **Scrutinize Consent Screens:** Teach users to look carefully at the permissions requested on any OAuth consent screen. An application asking for `Mail.ReadWrite.All` should be a major red flag.

 A security awareness program is not a one-time event. It requires continuous reinforcement. A program like **Edureka's Cybersecurity Awareness training** can provide the materials needed to build this critical defensive layer.

Step 2: Technical Controls — Harden Your M365 Tenant

As an administrator, you have powerful tools to prevent this attack:

• **Configure User Consent Settings:** In your Azure Active Directory, configure user consent settings to "Do not allow user consent" or "Allow user consent from verified publishers." This prevents users from being able to approve new, risky applications on their own.
• **Audit Existing OAuth Applications:** Regularly audit all applications that have been granted consent in your tenant. Review their permissions and revoke access for any that are unused, overly-privileged, or suspicious. You can do this in the Azure AD portal under "Enterprise applications."

---

Chapter 5: Strategic Summary & Indicators of Compromise (IOCs)

The UNC6040 threat actor and their Vishing-to-OAuth attack chain are a clear signal that as technical defenses like MFA become stronger, attackers will increasingly shift their focus to social engineering the human operator. A resilient defense requires not only the best technology but a well-trained and skeptical workforce. Hardening your cloud tenant's consent policies is a critical, non-negotiable step in building a modern Zero Trust architecture.

Indicators of Compromise (IOCs)

Security teams should hunt for the following patterns:

• **Malicious OAuth Application Names:** `M365 Account Sync`, `Office Security Scanner`, `SSO Verifier` (look for newly created Enterprise Applications with these names).
-
• **Suspicious Consent Grants:** Audit logs showing a user granting high-privilege permissions (e.g., `Mail.ReadWrite.All`) to a new, previously unseen application.
-
• **Anomalous API Usage:** After a suspicious consent, monitor the activity of the application's service principal for unusual patterns, such as accessing a large number of mailboxes or downloading an unusual volume of files.

🔒 Secure Your Cloud Environment with CyberDudeBivash

• Microsoft 365 & Azure Security Assessments
• Corporate Security Awareness Training Programs
• Cloud-Native Incident Response

Contact Us Today|🌐 cyberdudebivash.com

   

       

About the Author

       

CyberDudeBivash is a cybersecurity strategist and researcher with over 15 years of experience in cloud security, identity and access management, and defending against state-sponsored threats. He provides strategic advisory services to CISOs and boards across the APAC region. [Last Updated: October 02, 2025]

   

  #CyberDudeBivash #APT #Vishing #OAuth #MFA #Microsoft365 #CyberSecurity #ThreatIntel #InfoSec #SocialEngineering