oauth abuse3 articles
Stolen ConnectWise Credential Gives Attackers the Keys to 173 Microsoft 365 Tenants
Unknown threat actors have compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to 173 customer and partner M365 tenants on October 15, 2026. Because the backup application holds broad permissions across mailboxes, OneDrive, SharePoint, and Teams, the attackers inherited extensive access to sensitive data in every affected tenant, with some activity also involving privilege escalation by adding Global Administrator rights and new credentials to other trusted applications. In response, ConnectWise has shut down Cloud Backup application access, while security firms and Microsoft are urging affected organizations to disable the app, audit service principal sign-in logs for the suspicious IP address (144.172.64.128), and review any credential changes made since October 13.
Three Russian Spy Groups Are Running OAuth Phishing Ops Against Western Targets
Google's Threat Intelligence Group has identified three suspected Russian cyber-espionage groups — UNC6293, UNC7005, and UNC5976 — conducting highly targeted phishing campaigns against individuals in government, academia, aerospace, and think tanks across Europe and the US. The groups, likely linked to Russia's SVR intelligence service, have increasingly abused legitimate OAuth authentication flows to steal account access tokens, making their attacks harder to detect as malicious. Targets are urged to be vigilant about unsolicited calendar invites, conference invitations, and file-sharing requests, which the operatives use as lures to compromise personal and professional accounts.
ToddyCat's Umbrij Malware Quietly Hijacks Gmail via OAuth Abuse
The ToddyCat APT group has developed a new malware called Umbrij that exploits OAuth 2.0 and the Google API to covertly access victims' Gmail accounts. The tool works by launching a Chromium-based browser in headless mode, hijacking an active Gmail session via remote debugging, and using Puppeteer to automate the OAuth authorization process — ultimately obtaining an access token granting full access to Gmail, Drive, Contacts, and other Google services. Organizations are advised to check for unauthorized OAuth app connections, particularly those named "Google Workspace Migration/Sync for Microsoft Outlook," and revoke any suspicious access tokens.