The New Phishing Click: How OAuth Consent Bypasses MFA
Summary: A phishing-as-a-service platform called EvilTokens went live in February 2026 and compromised more than 340 Microsoft 365 organizations across five countries within five weeks by directing users to enter a code at microsoft.com/devicelogin and complete a normal MFA challenge. Users who complied handed the operator a valid refresh token scoped to their mailbox, drive, calendar, and contacts, which survived password resets and remained valid for weeks or months depending on tenant configuration.
Key Takeaway: The 2025 Salesloft-Drift incident spread a single compromised downstream connector across more than 700 Salesforce tenants through OAuth tokens each customer had legitimately approved - none of them authorized the cascade, and no single application's audit log could see it.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026