One Click on “Continue” Can Hand Attackers Your Entire Mailbox
Summary: Rajan Kapoor, VP of Security at Material Security, built and deployed a malicious OAuth app to demonstrate that a single click on "Continue" can hand an attacker an entire mailbox with no password, malware, or alarms. The demonstration shows live email exfiltration, lateral movement into connected services, and covert message deletion that leaves no trace, and he flags where Google's own consent screens fall short.
What's compelling: The compromise requires no password and no malware, so the controls most organizations rely on for credential theft and endpoint infection never fire - and the deletion is covert enough that the victim may never see the exfiltration at all.
Read the original at The Hacker News ↗
- Topics
- Privacy
- Related
- Italy Fines Meta €805 Million Over Facebook's Android Gallery Access Without Explicit Consent Cyber Risks · Nov 15, 2026