Varonis researchers discovered that invisible Unicode characters allowed attackers to bypass Microsoft’s reserved-name safeguards and register malicious Azure applications with deceptive names like “Azure Portal,” enabling illicit consent grants and device code phishing to obtain access tokens without stealing passwords. Microsoft patched the initial vulnerability in April 2025 and a broader set of characters in October 2025, protecting customers automatically. #AzurePortal #CombiningGraphemeJoiner
Keypoints
- Varonis found a method to insert invisible Unicode characters (e.g., 0x34F Combining Grapheme Joiner) between characters to impersonate Microsoft application names such as “Azure Portal.”
- Attackers can use malicious Azure apps to achieve initial access via illicit consent grants and device code phishing, obtaining access tokens without passwords.
- Microsoft implemented safeguards blocking reserved names, but researchers identified 262 Unicode characters that could bypass those checks until fixes were applied.
- Microsoft patched the first vulnerability in April 2025 and the additional characters in October 2025; customers are protected and need not take action for those patches.
- Misleading app names combined with app images increase the likelihood victims will consent despite warnings that the app is not Microsoft-owned.
- Recommendations include restricting user consent, applying least-privilege, monitoring Azure applications (including for non-ASCII characters in names), and user education against phishing.
- When unmanaged, malicious Azure applications can enable persistence and privilege escalation in Microsoft 365 tenants, risking data loss and reputational damage.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Using invisible Unicode characters to bypass name validation and register malicious Azure applications that impersonate Microsoft services: “we found that the Combining Grapheme Joiner ͏character (0x34f) allows us to create ‘Azure Portal’ as the application name by adding it between each character in the name.”
- [T1193] Spearphishing Link – Sending victims a link that redirects to a consent page or verification URI to trick users into granting app permissions: “sharing a link to what appears to be a file that redirects to the consent page. Once the user consents, the attacker can show the file or an error.”
- [T1078] Valid Accounts (Device Code Phishing) – Using device code flow and verification URIs to obtain access tokens without passwords once the victim enters the user code: “they can generate a verification URI and user and device code…the attacker uses the device code to receive the victim’s access token.”
- [T1553] Create or Modify System Process (Application Registration for Persistence) – Creating applications and using compromised admin consent to grant high privileges to service principals for persistence: “The attacker created the app … and used an admin they have a hold over to allow the relevant Service Principal high privileges.”
Indicators of Compromise
- [Application Names] deceptive app display names used to impersonate Microsoft services – “Azure Portal” (with invisible Unicode chars), other reserved names like “Microsoft Azure CLI” and “Microsoft Teams”.
- [Unicode Characters] characters used to bypass name validation – 0x034F (Combining Grapheme Joiner), 0x17B4, 0x17B5, 0x180B, and ranges 0xFE00–0xFE0F, 0xE0100–0xE01EF (and other characters totaling 262).
- [Attack Techniques] phishing artifact examples – consent-grant redirect links and verification URIs/user & device codes used in device code phishing (no specific domains provided).