Hunting SharePoint Access Token Theft with Webamon

This Webamon analysis details an active SharePoint/OneDrive-themed phishing campaign that uses disposable domains and Cloudflare-hosted portals to harvest Microsoft 365 access tokens (OAuth), enabling MFA bypass and cloud data exfiltration; it links a persistent Link Fingerprint to multiple malicious domains and Netiface-hosted IPs, provides IOCs and vendor detections, maps the activity to MITRE ATT&CK techniques, and recommends blocking and monitoring the identified infrastructure.