Tag

#OAuth

2 articles tagged #OAuth.

Cybersecurity/Identity & Access·Aug 3, 2026·5 min read

Device Code Phishing Is Beating MFA. Here's How EvilTokens Does It

EvilTokens is a phishing-as-a-service kit abusing OAuth's device code flow, and it doesn't need a fake login page to work. Here's how the attack actually runs and the Conditional Access policy that stops it.

CybersecuritySecuritySocial Engineering

Read

ShinyHunters' Vishing Playbook: How a Phone Call Is Breaching SaaS-Connected Companies

P.02

Cybersecurity/Social Engineering·Jul 28, 2026·5 min read

ShinyHunters' Vishing Playbook: How a Phone Call Is Breaching SaaS-Connected Companies

Microsoft mapped a year of ShinyHunters activity to three attack paths into Salesforce and other SaaS platforms, and the most common one starts with a phone call, not an exploit. Here's how the OAuth consent trick works and how to close it.

CybersecuritySecuritySocial Engineering

Read