Why do supply chain, OAuth phishing, and access token attacks keep working against mature organisations?

These attacks persist because they exploit trusted identity pathways rather than traditional malware alone. If a token, vendor integration, or consent grant is accepted as legitimate, the attacker can move through systems with less friction and fewer alerts. Mature organisations often have strong perimeter controls but weaker governance for delegated access and third-party credentials.

Why This Matters for Security Teams

Supply chain, OAuth phishing, and access token attacks keep succeeding because they target trust relationships, not just endpoints. Once an attacker obtains a delegated consent grant, an API token, or a vendor integration path, the activity often looks like normal business traffic. That makes these incidents hard to distinguish from legitimate automation unless governance extends beyond the perimeter and into identity, consent, and secret handling. The pattern is visible across cases such as the Salesloft OAuth token breach and the Vercel Context.ai OAuth Supply Chain Breach, where trusted integrations became the attack path.

This is why mature environments still get hit. Perimeter defenses can be strong while delegated access remains weakly governed, over-permissioned, or poorly revoked. The issue is amplified when secrets are copied into build systems, chat tools, or support workflows, which creates multiple exposure points outside traditional controls. NHIMG research in The State of Secrets in AppSec shows how fragmented secrets management and slow remediation leave dangerous credentials live long after exposure.

In practice, many security teams discover the weakness only after a vendor token has already been abused or a consent grant has already been weaponised, rather than through intentional testing of delegated access paths.

How It Works in Practice

These attacks usually succeed by making malicious activity inherit legitimate identity context. In OAuth phishing, the user is tricked into approving an app or scope that appears harmless but grants access to mail, files, CRM records, or downstream APIs. In supply chain abuse, the attacker compromises a partner, package, CI/CD runner, or integration service and then rides that trust into the target environment. In access token attacks, the stolen token is replayed directly until it expires, is revoked, or is blocked by additional policy.

The control model has to follow the identity pathway, not just the network boundary. Current guidance from OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 Security and Privacy Controls points toward tighter secret lifecycle management, scoped authorization, and revocation discipline. Practitioners should:

• Minimise OAuth scopes and review consent grants as privileged access, not as routine onboarding.
• Use short-lived tokens where possible and revoke immediately on vendor compromise, app removal, or anomalous use.
• Inventory third-party integrations, service accounts, and API keys with the same rigor applied to human privileged accounts.
• Detect unusual token use patterns such as new geographies, new user agents, privilege escalation, or tool chaining.

NHIMG’s 52 NHI Breaches Analysis shows how often identity trust, not malware sophistication, is the durable advantage attackers exploit. CISA cyber threat advisories also reinforce that credential theft and trusted-channel abuse remain recurring intrusion patterns across sectors. These controls tend to break down when organisations lack complete visibility into delegated apps, because revocation and scope reduction cannot be applied to identities that were never inventoried.

Common Variations and Edge Cases

Tighter token and integration controls often increase operational overhead, requiring organisations to balance blast-radius reduction against developer velocity and third-party dependency management. The tradeoff is real: overly broad blocking can break automation, while overly permissive trust keeps exposure alive.

One edge case is internal applications that use long-lived API keys because short-lived token exchange has not been implemented yet. Another is shadow IT, where business teams approve SaaS integrations outside central review and the security team learns about them only after anomalous access appears. Best practice is evolving for these scenarios, but current guidance suggests treating every non-human credential as a managed asset with owner, scope, TTL, and revocation path.

This is also where supply chain compromise becomes difficult to contain. The Shai Hulud npm malware campaign illustrates how upstream package or workflow compromise can expose secrets across many downstream environments. For broader adversary patterns, MITRE ATT&CK Enterprise Matrix helps teams map token theft, persistence, and lateral movement to real tactics. These controls tend to break down in highly federated environments because no single team owns the full trust chain from consent grant to downstream data use.

Related resources from NHI Mgmt Group

• Why do dependency confusion attacks keep working in mature organisations?
• Why do identity-related attacks keep succeeding against Active Directory environments?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How should organizations respond to OAuth token abuse incidents?