The campaign involves a number of OAuth apps impersonating credible brands to gain verified status from Microsoft. According to researchers, a user who clicked on a consent prompt would hand malicious actors the ability to read their emails, adjust mailbox settings and gain access to other parts of their Microsoft account.