OAuth Attacks Bypass MFA by Targeting Tokens, Unit 42 Warns
Attackers are increasingly targeting OAuth tokens, which grant access to applications and data, bypassing multi-factor authentication and surviving password resets, according to Unit 42 research.
Cyber adversaries are evolving their tactics beyond traditional credential theft, now focusing on compromising Open Authorization (OAuth) tokens. These tokens act as keys that permit applications to access user data and perform actions on their behalf. The shift is driven by the effectiveness of these attacks, which can bypass multi-factor authentication (MFA) and persist even after a user resets their password, offering attackers durable access to sensitive information.
Unit 42's research highlights that attackers are accelerating these OAuth-based attacks by employing sophisticated methods. These include dynamic evasion code to evade detection, phishing-as-a-service (PhaaS) templates to streamline campaigns, and the use of Large Language Models (LLMs) to generate convincing brand impersonations. Because these attacks occur at the authorization layer, after a user has already authenticated, the stolen tokens can grant attackers persistent access without triggering credential-based alerts.
The consequences of successful OAuth token theft can be severe. Attackers can achieve complete account takeovers, gain persistent access to sensitive data that survives password resets and MFA re-enrollment, and facilitate lateral movement across all services connected to the compromised identity. This can also provide a crucial foothold for broader supply chain attacks or insider threats within an enterprise environment.
Historically, before the widespread adoption of OAuth, applications often required users to share their direct login credentials to integrate services. This pre-OAuth era meant that a single credential compromise could grant an attacker access to multiple platforms. The OAuth protocol was developed to address these security challenges by allowing users to grant limited, temporary access to specific data and functionalities without sharing their primary passwords.
The OAuth framework, particularly OAuth 2.0 (standardized in RFC 6749 in 2012 and currently evolving towards OAuth 2.1), enables users to authorize third-party applications to access their data from an identity provider (IdP) like Google, Microsoft, or Apple. In a typical flow, a user authenticates with the IdP, approves the permissions requested by the third-party app, and the IdP issues an access token. This token is designed to be temporary and scoped, granting the application specific, limited access on the user's behalf.
However, the very design that makes OAuth convenient also presents an attack surface. OAuth-based phishing bypasses the initial login and MFA process. Victims authenticate through legitimate IdPs, complete MFA, and are then redirected with tokens that attackers can intercept. This creates a critical vulnerability between the authentication and authorization steps. Furthermore, a significant percentage of OAuth-enabled websites request more permissions than strictly necessary, increasing the potential for privacy and privilege leaks.
A core vulnerability lies in the practical implementation of OAuth tokens, which often outlive their intended lifespan. Unlike passwords, tokens are frequently configured to be long-lived, survive password resets because they are not tied to the password itself, and bypass MFA since the user has already authenticated. Refresh tokens can silently mint new access tokens for extended periods, providing persistent access until explicitly revoked. This persistence amplifies authorization vulnerabilities such as Cross-User OAuth Session Fixation (COSF), Cross-Tenant Client ID Confusion, and Cross-Connector OAuth Account Takeover.
Organizations can bolster their defenses against these evolving threats by implementing several key strategies. These include disabling end-user application consent for applications with vague or impersonating names, enforcing administrator-only approval workflows for app integrations, monitoring authorization code clipboard events for suspicious activity, and continuously auditing registered redirect URI values to prevent misdirection attacks. Proactive monitoring and strict access controls are crucial to mitigating the risks associated with OAuth token compromise.