OAuth token theft bypasses MFA and outlives password resets, Unit 42 says
Original title: The Current Landscape of OAuth Attacks
Stolen access and refresh tokens can persist for days or months and move across services tied to the same identity.
Unit 42 says attackers are shifting from password theft to stealing OAuth access and refresh tokens after victims authenticate with legitimate identity providers and complete MFA. Those tokens bypass MFA, survive password resets, and can support account takeover, data access, and lateral movement. The write-up cites phishing-as-a-service templates, dynamic evasion code, and LLM-generated brand impersonation, and names Cross-User OAuth Session Fixation, cross-tenant client ID confusion, and cross-connector OAuth account takeover.
Unconfirmed: The article is a landscape analysis and is cut off before the COSF description is finished.
- A cited analysis found 18.53% of OAuth sites request more than minimum permissions.
- Refresh tokens can mint new access tokens for days or months until revoked.
- IETF published OAuth 2.0 as RFC 6749 in 2012 and is working on OAuth 2.1 as of 2026.
- Defenses include blocking vague app consent and auditing registered redirect_uri values.
Impact: Persistent token access that bypasses MFA and password resets
- 1.Disable end-user consent for vague or impersonating app names.
- 2.Enforce admin-only approval for OAuth app consent.
- 3.Audit registered redirect_uri values and watch authorization-code clipboard events.
- Products
- OAuth
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | sieprevencion.cl | -generated resources on domain hosting device code campaign sieprevencion[.]cl . The operational advantages provided by LLMs include: Hi |
From the original article
13 min read at unit42.paloaltonetworks.com
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42.
By Ria Bhatia · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.