Mar 23, 2025
Mar 23, 2025
OAuth attacks are emerging as a favored tactic by cybercriminals. The growing wave of OAuth attacks isn't coincidental either—it's strategic, as they are difficult to detect, often bypass traditional controls, and provide direct access to business-critical systems.
OAuth attacks are rapidly emerging as a favored tactic by cybercriminals targeting SaaS ecosystems. The growing wave of OAuth attacks isn't coincidental either—it's strategic. These attacks are difficult to detect, often bypass traditional controls, and provide direct access to business-critical systems.
OAuth permissions are also deceptively easy for users to grant, and impersonating authorization requests via emails, Slack, and Teams is a low-effort, high-reward tactic. With so many apps in use across the enterprise, malicious ones can easily blend in. To compound the issue, sophisticated threat actors now leverage AI to craft polished phishing emails and make malicious apps look like trusted platforms to deceive even tech-savvy users, including extension developers.
The recent attacks targeting Microsoft 365, GitHub, Cyberhaven, as well as the highly sophisticated Midnight Blizzard attack on Microsoft are perfect examples. While security teams spend resources hardening identity access, endpoint detection, and cloud security posture, OAuth remains an under-protected backdoor waiting to be exploited.
The problem stems from the fact that most security teams lack the necessary visibility into which applications have been granted risky OAuth scopes, making it nearly impossible to proactively defend against these attacks.
Recent attacks demonstrate how adversaries leverage OAuth to bypass traditional security controls.
Similar to the Cyberhaven attack, threat actors deployed malicious OAuth applications disguised as legitimate services. In this latest incident, Microsoft OAuth apps masquerading as Adobe Acrobat and DocuSign tricked users into granting broad permissions. Once approved, these applications redirected users to phishing sites, installed malware, and stole Microsoft 365 account credentials—all without triggering security alerts.
GitHub developers were also targeted in a separate attack. Threat actors sent deceptive security alerts that prompted developers to authorize a rogue OAuth application. Once permissions were granted, attackers could access private repositories, inject malicious code, or exfiltrate proprietary data—without requiring stolen credentials or breaching corporate networks.
Midnight Blizzard, a Russian nation-state threat group, demonstrated OAuth’s power in an attack against Microsoft last year. After securing initial access, the attackers compromised and manipulated OAuth applications to gain broad access to corporate email systems. They created additional OAuth apps with elevated permissions, leveraging the already compromised application to further entrench their access. By abusing OAuth tokens, they bypassed MFA and maintained persistent access, allowing them to exfiltrate sensitive data undetected.
Similarly, the Cyberhaven breach illustrated another OAuth-based risk: a consent phishing campaign resulting in an employee unknowingly granting excessive permissions which were later used as an entry point for data exfiltration. This highlights an issue beyond malicious attacks—well-intentioned users can inadvertently introduce risk by authorizing applications with unverified OAuth applications.
These incidents highlight a fundamental issue: OAuth’s token-based trust model is being weaponized to create persistent access that is extremely difficult to detect and remediate.
While OAuth scopes are designed to grant granular access, many applications request far more permissions than they actually need. Worse, many security teams lack the ability to continuously monitor which applications have been granted, how the permissions were granted (by a person or by an app) and whether they pose a risk.
The problem is exacerbated by:
OAuth security remains a significant challenge; the key to mitigating the risks is implementing the right tools and gaining insights to efficiently manage OAuth scopes across an organization. This includes:
Grip’s SaaS Security Control Plane and browser extension, Grip Extend, both provide security teams with the visibility and control needed to manage OAuth security effectively, including permissions granted to shadow applications. By continuously monitoring OAuth grants, identifying high-risk applications, understanding OAuth trends, and providing automated remediation, Grip helps organizations eliminate blind spots and mitigate the risks associated with excessive OAuth permissions.
See how it works in this self-guided tour:
Key capabilities include:
OAuth management is an essential part of SaaS security. Organizations that fail to address it risk being blindsided by an attack they never saw coming. With the right visibility, controls, and automated remediation, security teams can take back control and stop OAuth-based risks before they escalate. To discuss how Grip can help you proactively and effectively secure your SaaS environment, book time with our team.
Fill out the form and watch webinar's video.
