AI-augmented phishing and OAuth abuse are reshaping identity risk

At a glance

What this is: This is a 2026 threat landscape update showing that identity compromise, device code phishing, OAuth abuse, and AI-accelerated phishing kits are now industrial-scale attack patterns.

Why it matters: It matters because IAM, IGA, PAM, and browser-layer controls must now defend against attackers who target authorization flows, not just passwords, tokens, or endpoints.

By the numbers:

• Of the browser and identity-related breaches we've tracked, SLH-affiliated groups are responsible for roughly 70% . Public breaches and campaigns with a browser and identity-related breach vector in 2026.
• We saw a huge spike in device code phishing since the start of 2026, with 25+ distinct kits now offering the technique.
• Sekoia documented the ErrTraffic MaaS platform achieving a 60% victim conversion rate.
• Push researchers found the mechanics for a live attacker relaying credentials and pushing new prompts in real time during the call, across 400+ linked domains and four infrastructure clusters.

👉 Read Push Security’s threat landscape update on AI-augmented phishing and identity abuse

Context

Browser-based identity abuse has become the preferred route for modern phishing and SaaS compromise. Attackers are no longer relying on a single lure type, because help-desk impersonation, device code phishing, AiTM credential harvesting, and OAuth abuse all let them bypass controls that were designed around static login events rather than live authorization flows.

For IAM and identity security teams, the operational problem is not just stolen credentials. The bigger issue is that attackers now chain browser interaction, token issuance, and downstream SaaS access into one continuous workflow, which means the browser, not the endpoint or IdP alone, has become a primary enforcement point for identity governance.

Key questions

Q: How should security teams defend against device code phishing in SaaS environments?

A: Treat device-code entry as an authorization event, not a benign login step. Limit which users and applications can use device flow, monitor unusual code-entry patterns, and require step-up verification for high-risk contexts. Browser-layer controls matter because the victim is often on a legitimate page while the attacker waits for the token to be issued.

Q: Why do OAuth tokens increase lateral movement risk in SaaS environments?

A: OAuth tokens increase lateral movement risk because they can remain valid after the initial user session, bypass MFA, and preserve scoped access until revoked. In SaaS environments, that makes a single consented app a durable bridge into email, files, logs, and admin-adjacent data. Identity governance must treat token scope and revocation as first-class controls.

Q: What do security teams get wrong about AI-powered phishing?

A: They often overestimate human ability to spot deception. AI makes phishing messages, voice, and video more convincing, so security teams need phishing-resistant authentication, tighter approval workflows, and independent verification for any request that can change access or move money.

Q: Who is accountable when SaaS access persists after a tool is no longer needed?

A: Accountability sits with the business owner, the application owner, and the identity governance team together. If any one of them assumes someone else will remove access, the entitlement can remain active long after the business use case ends. Lifecycle control must be assigned before the tool is put into production.

Technical breakdown

Why device code phishing bypasses MFA and passkeys

Device code phishing targets the authorization grant rather than the login screen. The victim is tricked into entering a short code into a legitimate device-flow page, which causes the identity provider to issue a token to the attacker’s session. That makes the attack compatible with MFA and even passkeys, because the attacker is not trying to crack the factor itself. The technique scales well in phishing-as-a-service because the operator only needs a convincing lure and a code relay path. The result is a control-plane attack on authentication, not a password-stealing exercise.

Practical implication: security teams must treat device-flow approvals as a governed access surface, not a harmless user convenience.

How OAuth supply chain abuse turns vendor trust into lateral movement

OAuth supply chain abuse works when a compromised SaaS vendor or integration holds tokens that are already trusted by downstream customer environments. Once those stored tokens are stolen or replayed, the attacker inherits delegated access without needing to reauthenticate to each customer tenant. This is not classic account takeover. It is trust propagation through third-party authorizations, which is why the blast radius can extend from one vendor compromise into hundreds of customer environments. For identity teams, OAuth consent, app trust, and vendor offboarding become security controls, not administrative tasks.

Practical implication: review third-party consent grants and downstream token exposure as part of your access governance model.

Why browser-layer detection now matters more than indicators

The report shows attackers rapidly rotating domains, payloads, and infrastructure, often with AI-assisted kit development. That compresses the lifespan of indicators such as hashes, IPs, and URLs. Behavioral signatures, by contrast, remain stable because the attacker still has to perform the same actions: relay credentials, inject clipboard payloads, or complete a device-code authorization. Browser-layer telemetry can observe those actions in real time, regardless of how often the kit is repackaged. That makes the browser an identity enforcement point, not just a user interface.

Practical implication: prioritize detection logic that keys on technique behavior rather than reputation-based indicators.

Threat narrative

Attacker objective: The attacker wants durable access to identities, SaaS data, and delegated authorization paths that can be monetized through theft, extortion, or downstream compromise.

1. Entry begins with vishing, browser phishing, device code lures, or OAuth compromise that gets the victim or integration into the attacker’s workflow.
2. Escalation occurs when the attacker obtains tokens, session access, or delegated SaaS permissions that bypass the original login boundary.
3. Impact follows through SaaS data theft, extortion, downstream tenant compromise, or cloud console access that the attacker can repeat at scale.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Dropbox Sign breach — compromised Dropbox Sign service account exposed API keys and OAuth tokens.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity compromise has become the default enterprise breach path. The report’s 70% figure for SLH-affiliated browser and identity-related breaches is not a noisy outlier, it is evidence of market convergence around identity as the easiest route to scale. That means attackers are optimizing for trust paths, not technical novelty. For practitioners, identity governance must now assume that phishing, token theft, and delegation abuse are the normal case, not edge cases.

Device code phishing is a governance problem, not just a phishing problem. Device-flow abuse succeeds because organisations treat authorization grants as user friction instead of access control. That assumption fails when a token is issued to an attacker after a victim completes a legitimate-looking step on a different device. The implication is that access approval and token issuance need to be treated as auditable control events, especially in M365 and SaaS-heavy environments.

OAuth supply chain abuse exposes trust without offboarding. Stored tokens and delegated app access create persistence that outlives the original relationship or security review. This is the same failure pattern seen when vendor access is never lifecycle-managed after integration changes. The practitioner lesson is that third-party authorization must be governed as a living entitlement, not a one-time integration decision.

AI is compressing attacker iteration, not changing attacker goals. The report shows AI-assisted kit building, faster evasion, and disposable infrastructure, but the underlying objective remains credential capture, token abuse, and data extortion. That means AI does not replace traditional identity threats, it accelerates them. Security teams should read the trend as a scaling event for existing IAM failure modes, not as a new category that invalidates the old ones.

Browser telemetry is becoming identity telemetry. When attackers operate through browser-based phishing, consent flows, and clipboard injection, the browser becomes the point where identity intent turns into access. That shifts control weight toward runtime observation of sessions and authorization actions. Practitioners should treat browser-layer enforcement as part of the identity stack, because the attack path now lives there.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• That confidence gap is why the Ultimate Guide to NHIs matters as a next step for lifecycle and governance planning.

What this signals

Third-party OAuth trust is now a governance exposure, not an integration detail. When visibility into connected vendors is incomplete, downstream token abuse becomes hard to contain because the entitlement graph is already opaque. Teams should expect more pressure to inventory consented apps and connect identity review workflows to SaaS offboarding.

Browser-based attack telemetry will increasingly define identity control maturity. If the attack path is happening inside the browser, then endpoint-only or IdP-only visibility will continue to miss the action that actually matters. Practitioners should align their detection strategy with technique-level controls and the browser-layer patterns described in the The 52 NHI breaches Report.

With 1.5 out of 10 organisations highly confident in securing NHIs, the market signal is not that attackers are unusually advanced, but that governance is still behind the operating reality. That gap will widen unless teams treat token issuance, consent, and lifecycle offboarding as core identity controls.

For practitioners

• Harden device-code authorization flows Restrict device code usage to the minimum set of applications and user groups, and log every grant as a high-risk authorization event. Pair that with user-facing warnings for code entry on unfamiliar pages so the browser becomes part of the approval boundary.
• Inventory and review delegated OAuth access Build a register of third-party apps, stored refresh tokens, and vendor-held OAuth grants across SaaS platforms. Reassess those grants after vendor compromise, contract changes, or business offboarding, because downstream access often persists long after the original trust decision.
• Treat help-desk impersonation as an identity attack path Update service desk procedures so passkey setup, account reset, and MFA re-registration requests require stronger verification and callback validation. Social engineering is succeeding because administrative workflow is still too easy to weaponize.
• Move detection to the browser layer Prioritise controls that observe credential relay, clipboard abuse, device-code entry, and consent actions in-session rather than relying on URL or domain reputation. These technique-level signals survive kit rotation and AI-assisted infrastructure churn.
• Separate authentication from authorization review Audit whether your IAM programme reviews login success while ignoring token issuance, OAuth consent, and downstream access persistence. The current threat set shows that the exploit often begins after authentication has apparently succeeded.

Key takeaways

• Browser-based identity compromise now accounts for the majority of the most visible phishing-driven breaches in this threat set, which makes authorization abuse a core IAM issue.
• Device code phishing, OAuth token abuse, and AI-accelerated kit development are all scaling the same old objective: trusted access to SaaS and cloud environments.
• Security teams need controls that govern authorization grants, consent, and downstream access lifecycles, not just login events and reputation signals.

Key terms

• Device code phishing: An identity attack that abuses the device authorization flow by tricking a user into entering a code on a legitimate login page while the attacker completes the flow elsewhere. It is effective because it relies on a real authentication protocol and can bypass password theft and familiar MFA prompts.
• OAuth Supply Chain Abuse: A compromise pattern where trusted third-party applications, integrations, or vendors are used to reach downstream customer environments. The security problem is delegated trust, because stolen or replayed tokens can persist across tenants and outlive the original access decision.
• AiTM Credential Harvesting: Adversary-in-the-middle phishing that intercepts a user’s authentication flow and captures session material or credentials in transit. In modern identity programmes, it matters because the attacker is stealing the authenticated session outcome, not merely the password.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Push Security’s full analysis covers the operational detail this post intentionally leaves for the source:

• Per-kit detection patterns for AiTM, device code phishing, and ClickFix campaigns across real-world infrastructure
• Examples of browser-layer telemetry that distinguishes credential relay from ordinary user activity
• Observed abuse patterns across OAuth supply chain attacks, including downstream token propagation
• Implementation detail on how the vendor detects phishing behavior at the browser layer

👉 Push Security’s full post covers the attacker playbook, kit evolution, and browser-layer detection detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM, IGA, or security architecture programme, it is worth exploring.