THE CURRENT LANDSCAPE OF OAUTH ATTACKS

Summary from the TLDR IT newsletter

Attackers can abuse OAuth through account hijacking, malicious app consent, and redirects. Phishing kits and AI-generated impersonation can be used to help campaigns scale. Stolen or fraudulently granted tokens can allow access after a legitimate MFA login and may persist after a password change, depending on token type and provider policy. Defenses include restricting user app consent, enforcing least-privilege permissions and auditing redirect URIs, and revoking compromised tokens and grants during incident response.