OAUTH TOKEN ABUSE: HOW THE ATTACK WORKS AND HOW TO STOP IT

Summary from the TLDR InfoSec newsletter

OAuth token abuse gives attackers application-level access that survives password resets and MFA, since tokens belong to the app rather than the user, and can be obtained through consent phishing, device code phishing, credential additions to existing apps, or preconsented first-party applications. Because malicious apps live in the attacker's tenant, defenders should watch victim-tenant Entra ID events (Add service principal, Consent to application, Add delegated permission grant, and app role assignments) alongside anomalous post-consent activity, with behavioral app-to-purpose checks coming from Defender for Cloud Apps rather than native audit logs. The highest-value controls are preventive: restrict user consent to verified low-impact apps, require admin approval for high-risk scopes like Mail.Read and offline_access, and keep an approved application inventory, since eviction requires removing the grant and service principal rather than resetting credentials.