The “Cookie Bite” attack presents a sophisticated method of compromising Microsoft 365 accounts by exploiting OAuth 2.0 permissions and session cookies tied to Azure Entra ID (formerly Azure AD). The campaign typically begins with well-crafted phishing emails that replicate Microsoft login pages. These emails trick users into granting access to a malicious application disguised as legitimate. Once a user consents, the rogue app receives OAuth access tokens, enabling it to perform actions like reading emails, browsing OneDrive files, or sending messages on the user’s behalf.

A key challenge in defending against this attack is token persistence. Even if a user resets their password, the attacker retains access through the granted OAuth tokens unless the user or administrator manually revokes permissions. These access tokens can be valid for extended periods, especially in environments with loose session expiration settings or over-permissive scopes.

Beyond OAuth exploitation, attackers reinforce their foothold by stealing session cookies specifically, ESTSAUTH and ESTSAUTHPERSISTENT which are essential for maintaining authenticated sessions in services like Outlook and Teams. These cookies are typically harvested via malware, such as infostealers or rogue browser extensions, or through man-in-the-middle techniques. Once in possession of these tokens, the attacker can inject them into their own browser session, bypassing multi-factor authentication entirely and impersonating the victim with full session continuity.

What makes this approach even more stealthy is the integration of Microsoft Graph API for automated data exfiltration. This enables attackers to systematically extract sensitive content such as documents, communications, and credentials with minimal visibility. In federated environments with misconfigured OAuth controls or absent monitoring for anomalous application consent, these breaches can go unnoticed for weeks.

Overall, the “Cookie Bite” technique underscores a growing threat landscape where attackers no longer rely solely on stolen credentials they exploit the very architecture of modern cloud authentication. By abusing both token-based authorization and session handling mechanisms, they achieve persistence, lateral movement, and data theft without triggering common security alerts.