How Attackers Exploit OAuth Tokens to Bypass MFA and Maintain Access
Summary
Unit 42 explains how OAuth phishing steals tokens after MFA, enabling persistent access, consent abuse and malicious redirects, and recommends admin-controlled consent, clipboard monitoring and redirect-URI audits.
Key points
- Stolen access or refresh tokens can bypass MFA, survive password resets and provide access to connected services until revoked.
- The article describes account hijacking through device-authorization codes or authorization-code theft, consent phishing that grants attacker apps scoped access, and malicious redirects used to deliver phishing or malware.
- It explains Cross-User OAuth Session Fixation, Cross-Tenant Client ID Confusion and Cross-Connector OAuth Account Takeover, including risks associated with long-lived tokens and shared OAuth-as-a-Service vaults.
- A cited large-scale analysis found that 18.53% of OAuth websites requested permissions beyond the minimum needed.
- Unit 42 reports observing phishing pages with runtime decryption and browser or sandbox evasion, reusable phishing-as-a-service templates, and signs of LLM-generated brand impersonation.
- The article notes Cloudflare’s June 2026 launch of self-managed OAuth clients, which can grant apps access to accounts controlling infrastructure such as DNS, CDN routing and edge compute.
- Recommended defenses include disabling end-user app consent, requiring admin approval, auditing redirect destinations, monitoring authorization-code clipboard activity and revoking risky grants.
Article Details
- Topic
- OAuth phishing, token theft, and related attack methods and defenses
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sieprevencion[.]cl | Domain identified as hosting a device-code phishing campaign. |
MITRE ATT&CK
T1528 · Steal Application Access TokenAttackers steal OAuth access or refresh tokens to obtain persistent access.T1550.001 · Application Access TokenStolen application access tokens are used to authenticate as victims on downstream services.T1566.002 · Spearphishing LinkPhishing links trick victims into authorizing attacker-controlled sessions or applications.
Vendors
CloudflareRuntime decryption: As observed in recent campaigns, threat actors deliver payloads as obfuscated blobs (using encryption algorithms such as AES-GCM) via edge infrastructure like Cloudflare Workers.GoogleFigure 1 displays a sample sign-in screen presenting OAuth authentication options with three different Identity Providers (IdPs): Google, Apple and Microsoft.MicrosoftFigure 1 displays a sample sign-in screen presenting OAuth authentication options with three different Identity Providers (IdPs): Google, Apple and Microsoft.