oauth news
3 stories
MFA Ineffective Against OAuth Consent Abuse Without Governance
A recent report highlights a significant limitation in the effectiveness of multi-factor authentication (MFA) when confronted with OAuth consent abuse. While MFA is widely recognized as a crucial security control, it does not inherently protect against the specific vector of attack that leverages misused or over-privileged OAuth consents. This finding underscores that even with MFA in place,…
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google's Threat Intelligence Group (GTIG) has identified three distinct Russia-linked cyber espionage clusters, designated UNC6293, UNC7005, and UNC5976, which are targeting researchers, academics, government officials, think-tank analysts, and defense sector personnel in Europe and the United States. These groups employ persistent and adaptive phishing campaigns, leveraging sophisticated…
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
Researchers have identified a sophisticated phishing campaign that bypasses traditional URL-checking defenses by exploiting a legitimate Microsoft authentication feature. The attack leverages the Microsoft Identity Platform's Device Authorization Grant, a protocol designed for devices with limited input capabilities, such as smart TVs or IoT devices, to authenticate users.