The Current Landscape of OAuth Attacks

What it is

A Unit 42 survey of OAuth phishing that steals tokens after the victim has finished MFA. It sorts campaigns into account hijacking, permission hijacking and malicious redirect, and adds notes on COSF, OAuth-as-a-service (OaaS) flaws, phishing-as-a-service (PhaaS) kits and LLM-built pages. It is a vendor overview with no CVEs, detection queries or tooling. The defences are policy-level.

How it works

Device authorization misuse. The attacker's server requests a device code, shows it to the victim, and tells them to paste it into the real login page (the page gives microsoft[.]com/devicelogin as an example). The victim signs in, and the attacker's session receives the token.

Authorization code theft. The attacker uses a legitimate app's registered redirect_uri so the code appears in the browser, then socially engineers the victim into handing it over. No malicious app registration is needed.

Permission hijacking. The victim consents to an attacker-registered app, either with a vague name (such as "Privacy Policy Extension" or "Security App") or a trusted brand name. The consent screen shows the name given at registration, not a verified identity.

Error-triggered redirect. Microsoft documented this campaign in March 2026. The attacker crafts an authorization URL that conflicts, for example prompt=none combined with parameters that need user interaction. The identity provider appends error parameters to the redirect_uri and sends the browser to the attacker's domain, with no error page shown. The page gives this URL shape:

<attacker-domain>/security/?state=<encoded-victim-email>&error=interaction_required&error_subtype=access_denied

Lax identity providers. If an IdP does not check for a client_id, it works as a generic open redirector. Permissive redirect_uri validation allows path traversal or URL parameters to reach attacker domains.

OaaS and COSF flaws.

• COSF: the attacker starts a "Connect your Slack" flow in a target app, freezes the session, and sends the victim the link. The victim logs into their real Slack account, but the token lands in the attacker's account.
• Cross-Tenant Client ID Confusion: a malicious tenant swaps its Client ID for a trusted tenant's in a shared token vault.
• Cross-Connector Account Takeover: a malicious tenant changes how the vault maps sessions to connectors, so a victim's flow is rerouted to the attacker.

Tradecraft trends. Payloads are AES-GCM-encrypted blobs served from Cloudflare Workers and assembled in the browser. Pages fingerprint for dev tools, sandboxes and headless crawlers, then loop in debuggers or route to legitimate domains. Unit 42 saw one template re-skinned for several document-sharing brands, and identical anti-bot and Cloudflare RUM tokens across campaigns. It also saw signs of LLM-generated pages.

Preconditions / Affected

• Tokens must be long-lived or refreshable. Refresh tokens can mint new access tokens for days or months.
• Conditional Access and IP controls do not help, because the token works for any presenter. Device-flow decoupling means strict IP or device checks would break the protocol.
• Cloudflare launched self-managed OAuth clients in June 2026. A malicious consent there could expose DNS, CDN routing and edge compute.
• A study cited by the page found 18.53% of OAuth sites request more than minimum permissions.

What to do

• Disable end-user consent for third-party apps and route requests through an admin consent workflow that prunes excess scopes.
• Block consent requests from apps with vague or impersonating names.
• Inventory all registered apps continuously and audit every redirect_uri. Quarantine any app that registers an external, recently created or unmanaged domain as a callback.
• Monitor clipboard copy and paste events, with source and target, to flag authorization or device codes pasted from untrusted sources before a token issues.
• Use a central consent policy to enforce least privilege, block unverified apps and revoke risky grants across IdPs.
• Train staff to treat consent screens like password fields and never to paste device or authorization codes into chat apps.

Caveats

• The page says OAuth misuse is lower in volume than traditional phishing.
• The clipboard monitoring and name-checking controls are described generically, with no product, configuration or query given.
• The LLM claim rests on code artefacts that "suggest" use, not confirmed attribution.
• Unit 42 says a follow-up post will cover how these attacks may evolve with AI agents.