OAuth Phishing

The Q2 2026 trend report from AhnLab ASEC documents a significant expansion of attack surfaces into AI stacks, identity infrastructure, and public-facing applications. CISA KEV listings rose 27% year-over-year to 75 entries, with ransomware-linked vulnerabilities nearly doubling. Notable developments include prompt injection-to-RCE chains in Microsoft Semantic Kernel, data exfiltration via M365 Copilot Enterprise (SearchLeak), three Microsoft Defender zero-days used for telemetry evasion, and continued AI supply chain attacks via malicious skills. The report recommends shifting from signature-based to behavior-based detection and implementing ITDR, conditional access, and AI-specific input validation controls.

Russian threat actor UTA0355 is conducting targeted phishing campaigns against foreign policy and government professionals by spoofing European security conferences. The attackers use rapport-building techniques and out-of-band messaging to trick victims into authorizing malicious Microsoft 365 OAuth applications and Device Code workflows, granting unauthorized access to their accounts.

2026-05-134 minHuntressmedium

Threat actors are increasingly targeting Google Workspace as a foundational identity layer to pivot into interconnected SaaS applications. Modern attacks bypass traditional endpoint defenses by utilizing stolen credentials, OAuth abuse, and malicious inbox rules to conduct Business Email Compromise (BEC) and maintain persistent access.