Why Attackers Are Now Stealing OAuth Tokens to Get Around MFA

As more organisations roll out multi-factor authentication (MFA), attackers have adapted. Instead of only stealing passwords, they are increasingly going after Open Authorization (OAuth) tokens. These tokens act like keys that decide what applications can do on your behalf. Unit 42 notes that attackers are speeding up these efforts with dynamic evasion code, phishing-as-a-service templates and brand impersonations generated by large language models.

The risk comes from where these attacks happen. OAuth misuse takes place at the authorization layer, after a user has already logged in. That means stolen access and refresh tokens can bypass MFA, survive password resets and give attackers durable access. Unit 42 says OAuth misuse occurs at a lower volume than traditional phishing, but the consequences can be severe.

The article also explains why OAuth exists. In 2006, before OAuth, linking one application to another often meant sharing secret credentials between them. That made credential phishing far more damaging, because compromising one account could let attackers pivot to other platforms and services. The OAuth working group released the first draft of OAuth Core 1.0 in 2007, and the IETF published RFC 6749 for OAuth 2.0 in 2012. Work on OAuth 2.1 is continuing as of 2026. This summary covers only the opening of the original article.