THE CURRENT LANDSCAPE OF OAUTH ATTACKS

Summary from the TLDR InfoSec newsletter

Attackers have shifted to stealing OAuth access and refresh tokens, bypassing MFA and surviving password resets, using device code phishing, consent screens for impersonated or vaguely named apps, and redirect_uri abuse that sends victims from real IdP domains to attacker pages. Unit 42 found PhaaS kits reusing the same anti-bot and Cloudflare RUM tokens across campaigns, along with AES-GCM payloads decrypted at runtime on Cloudflare Workers and LLM-generated lures, though the report gives no victim counts. Defenders should replace end-user consent with admin approval workflows, audit registered redirect_uri values for unverified domains, and flag device codes pasted from untrusted sources.