There is a growing type of phishing attack which has been quite successful since the beginning of 2020, it is called a "Consent Phishing"
Traditional email phishing attacks will try to get the victim's credentials through a dangerous URL with a fake login webpage, a malware attachment or some other clever social engineering tactics.
Hopefully companies have some anti-phishing tools/technology to detect and protect them against most of those type of emails (some always manage to get through, no matter what technology you use and what vendors promise you!)
However, there is a new type of phishing attacks that leverages the OAuth authorisation framework used by some applications to access your account. Basically, there are a lot of legitimate applications that will request access to your O365 account (it could also be another type of Cloud app provider) through the generation of an OAuth token, so they don't need to know (and store) your O365 password.
...
>>[READ MORE]