"The attack was less likely to be detected than traditional targeted phishing or brute force attacks [because] organizations typically have weaker defense-in-depth controls against threat actors using verified OAuth apps," wrote Proofpoint researchers Assaf Freidman, David Krispin and Eilon Bendet. Beginning Dec. 6, Proofpoint identified three malicious apps masquerading as legitimate OAuth programs, each created by different publishers. The campaign appears to mostly target UK-based organizations and users in the finance and marketing sectors, as well as managers and executives. A Proofpoint spokesperson told SC Media that they have also identified a number of non-UK victims in the scheme. Microsoft launched the publisher verification feature in 2020 in response to increasing application-based attacks, claiming that a verified app can demonstrate it comes from "an authentic source."