The attacker wants a durable app grant, not a password. Decide who can consent, what needs review, and how you prove revocation.

Your SOC isn’t understaffed. It’s late. ⏱️😈

Attackers aren’t scaling with malware—they’re scaling with OAuth + tokens + “normal” API exports. Big tech wins by yanking kill-switches fast. Can you revoke an OAuth grant in <30 min?

Your “AI coworker” isn’t the breach. The OAuth trust event is. 🔥🕵️

Device-code phishing + consent traps = “approve to exfil.” (And yes, AI agents are already being used as the wrapper.)

No malware. Still owned. 🧾🔑💬
Device-code phishing + Teams as the “lobby” + stolen OAuth tokens = API-speed SaaS exfil. If you’re hunting binaries, you’re late.

2025’s costliest US breaches: identity, outage math, outcomes

Identity-led intrusions at distributors, govtech, healthcare, and an appliance vendor drove nine-figure losses. Outage duration and revocation speed determined the spread between disruption and recovery.

2025’s priciest breaches weren’t “elite malware.” They were tokens + SaaS + downtime 🪙⏱️🔥
If your revoke MTTR is measured in days, the attackers already won.

Part 2: OAuth consent scams went from “one guy” to a token factory 🎅🏭🔑
Salesloft/Drift showed how stolen OAuth tokens → Salesforce tenant exfil at scale. Google Cloud+1
Deep dive + defenses (verified publisher, least scope, fast revoke MTTR).