The Current Landscape of OAuth Attacks

Attackers are shifting from credential theft to stealing Open Authorization (OAuth) tokens.
Stolen access and refresh tokens bypass MFA and survive password resets.
Attack techniques include dynamic evasion code, phishing-as-a-service (PhaaS) templates, and LLM-generated brand impersonations.
In a typical OAuth flow, the user authenticates with an IdP, approves permissions, and the IdP issues an access token to a third party application.
OAuth tokens can be configured as long-lived, surviving password resets and bypassing MFA.
Cross-User OAuth Session Fixation (COSF) allows attackers to use a long-lived token as a permanent backdoor by freezing sessions during authentication flows.
In Cross-Tenant Client ID Confusion, a malicious app swaps its identifier to impersonate a trusted app within the same OAuth service vault.
Account hijacking is achieved via Device Authorization Misuse or Authorization Code Theft using benign applications’ registered redirect URIs.
Defenses include disabling end-user app consent for vague app names and mandating admin-only approval workflows.

The narrative frames the evolution of digital trust, moving from a model reliant on static secrets (passwords) to one dependent on dynamic, ephemeral permissions (tokens). The central vulnerability exposed is not necessarily a flaw in OAuth's core cryptography but rather the operational friction points—the authorization layer and the human consent decision point. This architectural dependency creates an "authorization gap" where technical security measures designed for login events fail because the token itself represents successful pre-authorized trust.
The pattern here involves elevating vectors of attack from low-fidelity (mass phishing) to high-fidelity, embedded processes (token hijacking via SSO trusts). The emergence of PhaaS and LLM amplification is not merely a tool upgrade; it democratizes sophisticated identity compromise, lowering the required technical expertise for highly targeted operations. Organizations are forced into a reactive standardization game: since individual IdPs offer variable levels of protection, effective defense requires adopting an external, universal policy layer (third-party consent security).
The primary unstated assumption is that control over the endpoint—the browser environment or the central authorization policy—is achievable against actors who can automate evasion and impersonate trusted identities flawlessly. This points to a philosophical shift: digital security must move away from solely validating *who* a user is (authentication) toward continuously verifying *what* an authorized entity is attempting to do, even if that entity appears legitimate based on cryptographic proof.
How does the current regulatory or technical incentive structure reward the development of high-fidelity impersonation tools in this threat economy? What architectural shifts—beyond merely adding monitoring layers—are required to make tokens functionally incapable of persisting outside a tightly governed and continuously verified session context? How do we differentiate between an adaptive system defending against token theft and one that is merely sophisticatedly *tolerant* of exploitation across its many interconnected trust surfaces?
Patterns detected: ARC-0118 Paradigm Shift (Evolution from secret validation to permission verification).