OAuth token theft surges as attackers bypass MFA via device-code, consent phishing and redirect abuse, aided by PhaaS and LLMs

Linha do tempo

1. unit42.paloaltonetworks.com ↗ · pub. 22/10/2026 14:00 · coletado 22/10 15:00 primeiro registro

   OAuth token theft surges as attackers bypass MFA via device-code, consent phishing and redirect abuse, aided by PhaaS and LLMs

   ler a análise desta fonte ocultar

   Palo Alto Networks Unit 42 reviews the current OAuth attack landscape. Attackers are shifting from stealing passwords to stealing OAuth access and refresh tokens, which bypass MFA, survive password resets and give durable access. Unit 42 groups OAuth-based phishing into three categories: account hijacking, permission hijacking and malicious redirect. It says these campaigns are being accelerated by dynamic client-side evasion, phishing-as-a-service (PhaaS) templates and LLM-generated brand impersonation. OAuth misuse is lower in volume than traditional phishing, but the consequences are more severe.

   Technical Details

   • Account hijacking: abuse of the device authorization flow (the victim is tricked into entering an attacker-generated code on a legitimate page such as Microsoft's device login) and of the authorization code flow (a legitimate app's redirect_uri exposes the code, which is then extracted through social engineering).
   • Permission hijacking: the victim consents to an attacker-registered app with a vague name (e.g. "Privacy Policy Extension") or one impersonating a trusted brand. The consent screen shows only the registered name, not a verified identity.
   • Malicious redirect: attacker-owned redirect_uri values, or deliberately induced errors (prompt=none combined with parameters that require interaction) that make the IdP send the browser to an attacker landing page with error=interaction_required. This was documented by Microsoft in March 2026. Lax IdP validation (a missing client_id check or permissive redirect_uri matching) enables open redirection.
   • Protocol-level weaknesses: Cross-User OAuth Session Fixation (COSF), Cross-Tenant Client ID Confusion and Cross-Connector OAuth Account Takeover in OAuth-as-a-service token vaults. These get easier the longer a token stays valid.
   • Evasion: AES-GCM-encrypted payloads delivered through Cloudflare Workers and assembled at runtime, fingerprinting of dev tools, sandboxes and headless crawlers, debugger loops, and silent routing to legitimate domains.
   • PhaaS ecosystem: modular plug-and-play OAuth templates re-skinned for different document-sharing brands, with identical anti-bot and Cloudflare RUM tokens shared across campaigns.
   • LLM use: LLM-generated code was observed on the domain hosting a device-code campaign, sieprevencion[.]cl.
   • Cloudflare: the June 2026 launch of self-managed OAuth clients adds a high-impact consent surface (DNS, CDN, edge compute).
   • Why controls fail: Conditional Access and IP controls do not help because OAuth grants access to any token presenter.

   Remediation

   • Disable end-user app consent, or block vague and impersonating app names, and enforce admin-only approval workflows that prune excessive scopes.
   • Continuously audit registered redirect_uri values and quarantine apps that register external, newly created or unmanaged callback domains.
   • Monitor clipboard copy/paste events involving authorization or device codes.
   • Apply a centralized third-party consent policy that enforces least privilege and revokes risky grants uniformly across IdPs.
   • Train users to treat consent screens like password fields and never paste device or authorization codes into unverified apps or chats.