AI-augmented phishing and OAuth abuse are reshaping identity risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Push Security's blog post: AI is accelerating familiar identity abuse, especially phishing, device code theft and OAuth compromise, rather than creating a wholly new attack class.

Why it matters: It matters because IAM, browser security and SaaS governance now have to defend against faster operator turnover, more convincing lures and token-based lateral movement across cloud services.

Context

The core security gap in this article is not a lack of awareness about phishing, but a failure to govern identity abuse at the point where attackers now execute it: the browser and the consent flow. Device code phishing, AiTM kits and OAuth token abuse all exploit trust in authentication journeys that were designed for legitimate users, not operator-driven social engineering.

For IAM and NHI teams, the article is a reminder that access governance is only as strong as the mechanisms that issue, approve and reuse credentials. When attackers can reset accounts, harvest tokens, or ride delegated SaaS trust chains, the control problem shifts from password policy to lifecycle control over sessions, tokens and downstream app grants.

Key questions

Q: What breaks when device code phishing is not separately governed?

A: MFA can still fail if the user is tricked into approving a legitimate device authorization request. The access is then issued through the correct identity provider, which makes the session look normal even though the attacker initiated the flow. Teams need to govern the approval path itself, not just the password or second factor.

Q: Why do OAuth tokens increase lateral movement risk in SaaS environments?

A: OAuth tokens increase lateral movement risk because they can remain valid after the initial user session, bypass MFA, and preserve scoped access until revoked. In SaaS environments, that makes a single consented app a durable bridge into email, files, logs, and admin-adjacent data. Identity governance must treat token scope and revocation as first-class controls.

Q: What are the signs that phishing has moved from opportunistic to industrialised?

A: Look for frequent kit reuse, fast-changing infrastructure, overlapping lures across campaigns and the same social engineering pattern appearing in many incidents. When attackers can swap domains, rewrite payloads and continue using the same technique, indicator-only defenses lose coverage quickly.

Q: How should teams respond when help desk resets become part of the attack chain?

A: Treat account recovery as an access control surface, not a support task. Separate identity proofing from reset approval, require stronger verification for privileged accounts, and review whether passkey enrollment or MFA re-registration can be abused as a persistence step.

Technical breakdown

Why device code phishing defeats MFA and passkeys

Device code phishing targets the authorization layer rather than the login layer. In a normal device flow, the victim is asked to approve a code on a trusted device after an OAuth device authorization request starts the session. Attackers abuse that trust bridge by presenting their own code, often after a social-engineering pretext such as IT support or passkey setup. Because the authorization is made against the legitimate identity provider, MFA and even passkeys can be bypassed if the user is tricked into completing the flow. Practical implication: treat device authorization as a high-risk grant path, not just a login event.

Practical implication: Instrument device code grants as a distinct control point and block or step up risky approvals before tokens are minted.

How OAuth supply chain abuse becomes downstream lateral movement

OAuth supply chain abuse works when one compromised SaaS vendor becomes a trust broker into many customers. The attacker does not need to crack each tenant individually if stored tokens, app consents or delegated access can be reused downstream. This is a classic trust amplification problem: one upstream compromise turns into many authorized sessions in customer environments, often with no password theft at the downstream endpoint. The danger is not only the stolen token, but the persistence of granted consent and the invisibility of the original breach to each affected customer. Practical implication: inventory third-party app grants and continuously review which tokens can reach production data.

Practical implication: Continuously review third-party app consents and revoke stale OAuth grants before they become reusable access paths.

Why AI is compressing phishing kit development cycles

AI is not changing the mechanics of phishing so much as compressing the time it takes to build, evade and redeploy it. The article describes kits that are now verbose, quickly cloned, and easier to customize, which lowers the skill bar for operators and increases the frequency of infrastructure rotation. That matters because static indicators such as domains, hashes and file paths age out faster, while technique-level behavior stays consistent. Practical implication: behavioural detection at the browser and session layer matters more than chasing each new lure, domain or payload variant.

Practical implication: Shift detection toward behaviour at the browser layer because domains, hashes and kit names now change faster than response cycles.

Threat narrative

Attacker objective: The attacker wants durable identity-based access that can be monetised through data theft, extortion, account takeover and downstream tenant compromise.

1. Entry begins with social engineering, including vishing, passkey-themed lures and browser-based phishing that convinces the victim to start a legitimate authentication or support workflow.
2. Credential or grant harvesting follows when the victim enters credentials, approves a device code, or grants OAuth consent, giving the attacker a valid path into identity systems or SaaS tenants.
3. Escalation occurs when the attacker reuses those tokens or delegated app permissions to reach downstream environments, bypass MFA, or persist through additional registration and consent steps.
4. Impact is extortion, data theft and broad SaaS compromise, often across multiple customer tenants or cloud services reached through the same trust chain.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• MGM Resorts breach 2023: A help desk call gave attackers Okta and Azure admin access at MGM, leading to ransomware, ten days of outages and a $100 million hit.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity abuse has become an industrialised delivery model, not a one-off intrusion pattern. The article shows that the same social-engineering playbook is now being copied by criminal groups and adopted by others because it consistently produces access. That means identity teams are no longer dealing with isolated technique choice, but with a repeatable service model that turns human trust into scalable access. The practitioner consequence is simple: control design has to assume industrial reuse of identity attacks, not rare exception handling.

OAuth consent is now a governed access surface, not a developer convenience layer. Token reuse and delegated SaaS access turn a single upstream compromise into many downstream sessions, which is why app consent governance has become an identity control problem. This is where classic perimeter thinking breaks down, because the attacker is operating inside an authorised trust relationship. Practitioners should treat third-party OAuth grants as part of the entitlement estate, not as temporary configuration noise.

Device code phishing exposes a browser-era trust gap in modern MFA design. The flow was built to help legitimate devices complete authentication, but attackers can steer users into approving a grant they did not originate. That means MFA strength is not the same thing as MFA resilience when the approval path itself is socially engineered. The implication is that browser-facing authorisation decisions now need separate risk treatment from ordinary sign-in events.

Authorization-layer compromise: The article makes clear that attackers are bypassing login hardening by attacking the grant layer itself. That is a different failure mode from password theft, because the resulting session is born legitimate and often inherits broad downstream reach. Practitioners should rethink where they draw the boundary between identity proofing, consent and token issuance.

Browser telemetry is becoming the decisive identity detection layer. The attack techniques described here execute where users make trust decisions, and that is also where many legacy identity controls have the least visibility. Behavioural controls that see the approval moment, the redirect chain and the clipboard action can spot technique classes that static indicators miss. The field is moving toward browser-governed identity risk because that is where modern phishing now lands.

What this signals

Authorization-layer compromise: the attack surface has shifted from password entry to consent and grant issuance, which means identity controls have to see the approval moment as a security event. If the browser is where the decision happens, then browser-layer telemetry becomes part of the identity programme, not just a productivity tool.

The practical programme change is to treat third-party app consent, device codes and help desk recovery as one joined-up access lifecycle. That lifecycle now includes phishing, delegated access and downstream token reuse, which is why browser security and IAM operations are converging around the same control point.

For practitioners

• Harden device code approval paths Block or challenge device authorization requests that originate from untrusted contexts, and treat code entry as a privileged approval event rather than a routine login step.
• Inventory and review OAuth grants List third-party SaaS applications with consented access to production data, then retire grants that are no longer required or that exceed the business need.
• Detect browser-level phishing behaviour Use behavioural detection for redirect chains, clipboard injection, fake login flows and consent prompts instead of relying on domains and hashes alone.
• Separate social engineering from credential policy Map help desk resets, IT impersonation, passkey setup requests and MFA recovery into one abuse path so that the same operator cannot move from conversation to token issuance without scrutiny.
• Track downstream trust chains Identify which SaaS vendors can impersonate or provision access into customer tenants through stored tokens, then require stronger review for those high-reach integrations.

Key takeaways

• The article describes a threat market where social engineering, browser compromise and token abuse are converging into a repeatable access model.
• Device code phishing and OAuth supply chain abuse are important because they let attackers turn one successful lure into broader downstream access.
• Identity teams need to govern consent, recovery and browser-side approvals as active control surfaces, not after-the-fact investigation artefacts.

Key terms

• Device code phishing: An identity attack that abuses the device authorization flow by tricking a user into entering a code on a legitimate login page while the attacker completes the flow elsewhere. It is effective because it relies on a real authentication protocol and can bypass password theft and familiar MFA prompts.
• OAuth Supply Chain Abuse: A compromise pattern where trusted third-party applications, integrations, or vendors are used to reach downstream customer environments. The security problem is delegated trust, because stolen or replayed tokens can persist across tenants and outlive the original access decision.
• AiTM Phishing: Adversary-in-the-middle phishing inserts attacker infrastructure between the victim and the real login service. The attacker relays the login in real time, captures the issued token, and bypasses MFA by stealing the authenticated session rather than guessing the password.
• Consent Governance: Consent governance is the set of policies, systems, and evidence needed to collect, record, propagate, and withdraw permission for data processing. It becomes operationally meaningful only when the organisation can prove that downstream systems honour the decision consistently across channels and vendors.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.