OAuth token theft surges as attackers bypass MFA via device-code, consent phishing and redirect abuse, aided by PhaaS and LLMs
Palo Alto Networks Unit 42 reviews the current OAuth attack landscape. Attackers are shifting from stealing passwords to stealing OAuth access and refresh tokens, which bypass MFA, survive password resets and give durable access. Unit 42 groups OAuth-based phishing into three categories: account hijacking, permission hijacking and malicio…