Tag

#OAuth

8 articles covering OAuth across campaign analysis, detection engineering, and defender tradecraft.

Coverage

8 entries

Field Analysis

Dual UseInfrastructure IntelligenceMay 31, 20268 min read

Kali365 and the Productization of Token Theft

An FBI-flagged phishing-as-a-service kit rents Microsoft 365 token theft for $250 a month, packaging device-code and OAuth abuse into a point-and-click dashboard that defeats MFA without a fake login page.

Detect OAuth Abuse by Watching What Apps Do After Consent

A static permission review cannot catch a trusted integration whose token is later stolen or whose behavior changes.

By PhishPond Desk

Field Analysis

Blue TeamDetection & ValidationMay 6, 20267 min read

OAuth Consent Governance Needs a Front Door and a Cleanup Crew

Restricting new consent is only half the work. Existing app grants need review, ownership, and a path to removal when risk changes.

By PhishPond Desk

Field Analysis

Blue TeamDetection & ValidationMay 6, 20269 min read

The Drift Token Lesson Is SaaS Blast Radius, Not Just Vendor Risk

The Salesloft Drift incident showed how a trusted integration token can become an access path into customer SaaS data without a fresh user login.

By PhishPond Desk

Field Analysis

Blue TeamDetection & ValidationMay 6, 20268 min read

Unmanaged OAuth Grants Are the SaaS Back Door Hiding in Plain Sight

Persistent OAuth grants let third-party apps keep operating after the original login, password reset, or employee lifecycle event has faded from view.

By PhishPond Desk

Field Analysis

Blue TeamTradecraft LabsMay 1, 202611 min read

Device Code Phishing: A Walkthrough and Detection Playbook

Device code phishing turns a legitimate OAuth flow into a credential-free token theft technique. Here is how it runs end-to-end and what defenders can hunt on in Sentinel and Defender XDR.

Approval Fatigue Becomes the New Credential Theft Front Door

Attackers are blending push prompts, urgent collaboration lures, and identity fatigue to move users from suspicion to accidental approval.

By PhishPond Desk

Field Analysis

Blue TeamResearch ReportsApr 22, 202610 min read

Research Note: OAuth Consent Debt Builds Quietly Until Incident Response Needs It Gone

OAuth app grants accumulate over time, and stale consent can become a hidden access path when vendors, users, or integrations are later compromised.

By PhishPond Desk

#OAuth

Coverage

Kali365 and the Productization of Token Theft

Detect OAuth Abuse by Watching What Apps Do After Consent

OAuth Consent Governance Needs a Front Door and a Cleanup Crew

The Drift Token Lesson Is SaaS Blast Radius, Not Just Vendor Risk

Unmanaged OAuth Grants Are the SaaS Back Door Hiding in Plain Sight

Device Code Phishing: A Walkthrough and Detection Playbook

Approval Fatigue Becomes the New Credential Theft Front Door

Research Note: OAuth Consent Debt Builds Quietly Until Incident Response Needs It Gone

Browse Other Tags

#OAuth

Coverage

Kali365 and the Productization of Token Theft

Detect OAuth Abuse by Watching What Apps Do After Consent

OAuth Consent Governance Needs a Front Door and a Cleanup Crew

The Drift Token Lesson Is SaaS Blast Radius, Not Just Vendor Risk

Unmanaged OAuth Grants Are the SaaS Back Door Hiding in Plain Sight

Device Code Phishing: A Walkthrough and Detection Playbook

Approval Fatigue Becomes the New Credential Theft Front Door

Research Note: OAuth Consent Debt Builds Quietly Until Incident Response Needs It Gone

Browse Other Tags