Stealthware: The Rise of Malicious OAuth Apps in Microsoft 365

Not all attacks rely on malware—some abuse Microsoft 365’s built-in features. Stealthware - a type of Rogue Apps - is a growing threat where attackers create custom OAuth apps for persistence, data theft, and stealthy long-term access. Unlike traditional malware, these apps blend in, bypass MFA, and fly under the radar. Hackers craft these malicious OAuth applications to impersonate legitimate services, silently siphoning emails, modifying inbox rules, and maintaining persistent access. And once installed, these backdoors don’t trigger traditional security alerts. But with Huntress Managed ITDR (Identity Threat Detection & Response), now powered by Rogue Apps, we detect and dismantle these hidden threats—before attackers can exploit them.