Malicious attackers are using rogue OAuth apps to gain control of Microsoft Exchange servers and spread spam.