[DEEP RESEARCH] Zero-Days Are a Distraction: 2025’s Biggest Losses Were Stolen Tokens + OAuth

Part 2: OAuth consent scams went from “one guy” to a token factory 🎅🏭🔑
Salesloft/Drift showed how stolen OAuth tokens → Salesforce tenant exfil at scale. Google Cloud+1
Deep dive + defenses (verified publisher, least scope, fast revoke MTTR).

Zero-Days Are a Distraction: 2025’s Biggest Losses Were Stolen Tokens + OAuth

Zero-days get the headlines. Stolen tokens + OAuth consent abuse get the invoices. 🧾🔑😈
2025 pain = AiTM/device-code phishing + token replay + KEV-speed edge fires.

By Dec 31, 2025, will a reputable primary source (Oracle, CISA, Mandiant/MSTIC, affected org’s SEC 8-K/IR blog) confirm at least one breach where CVE-2025-61882 was the initial access vector?

Oracle EBS zero-day (CVE-2025-61882): OOB patch, KEV-listed, exec extortion emails flying. We’re at 76% that a primary source names it as initial access by 12/31. Raise or fade? 🧨🧭

Will RedNovember be publicly reported to exploit at least one zero-day vulnerability in 2026?

RedNovember likely stays fast-follow on edge devices using N-days and public PoCs, not 0-days. China-nexus peers show willingness to burn edge 0-days, so a pivot is plausible but not base case...

By Dec 31, 2025, will UNC5221 be publicly linked to exploiting at least one new zero-day?

Question: By Dec 31, 2025, will UNC5221 be publicly linked to exploiting at least one new zero-day in a non-Ivanti edge platform (e.g., VMware vCenter/ESXi, Citrix NetScaler, F5, Palo Alto, Fortinet)?