Browser and identity attacks now define modern SaaS compromise

At a glance

What this is: This re-released matrix reframes SaaS compromise as a browser and identity problem, arguing that initial access techniques now dominate the attacker playbook.

Why it matters: IAM, NHI and security teams need to govern the browser, authorization flows and session theft paths because post-compromise controls are arriving too late.

Context

Browser-based compromise now starts before a SaaS tenant is reached. The article argues that the critical failure point is initial access, where attackers compromise identities through browser-delivered phishing, OAuth abuse, device code prompts and malicious extensions rather than through application logic inside the tenant.

That shift matters because many programmes still treat SaaS compromise as an endpoint or post-login issue. Once session tokens, consent grants or device-code authorisations are obtained, traditional detection windows shrink sharply and identity controls become the only realistic choke point.

Key questions

Q: What breaks when identity attacks are not visible across cloud and SaaS systems?

A: When access behaviour is fragmented across tools, attackers can keep using legitimate credentials without standing out. The result is delayed detection, weak investigation trails, and blind spots around lateral movement. Security teams need joined-up identity telemetry so a session, a privilege change, and a suspicious resource access can be evaluated as one behavioural chain.

Q: Why do browser-delivered identity attacks often bypass traditional authentication controls?

A: Because the attacker is abusing the authorisation or browser session layer rather than forcing a normal login failure. Consent grants, device-code prompts and AiTM flows can succeed even when passwords, MFA and passkeys are present, since the attacker is manipulating a legitimate session or approval path instead of defeating the login stack directly.

Q: What are the signs that identity controls are not working as intended in the browser?

A: Common warning signs include false positives that users cannot distinguish from real warnings, high volumes of ignored alerts, repeated use of password logins where SSO should apply, and accounts that still show weak or reused credentials after remediation efforts. If controls are only generating events but not changing behaviour, the policy is not being enforced effectively.

Q: What should teams do when browser extensions can access identity workflows?

A: They should manage extensions like third-party software with identity reach, not like harmless productivity add-ons. That means approving what can be installed, tracking ownership changes, and reviewing whether an extension can read or modify authenticated web sessions. If an extension touches identity flows, it belongs in governance and monitoring scope.

Technical breakdown

Browser-delivered initial access is the main compromise path

The matrix argues that modern compromise increasingly begins in the browser, not inside the SaaS application. Techniques such as AiTM phishing, ClickFix, device code phishing and OAuth consent abuse are designed to capture identity state before an attacker needs to touch the target tenant directly. That changes the control boundary. EDR can miss the interaction entirely, network tools may see only ordinary web traffic, and the decisive moment becomes the browser session where the user is manipulated into giving up credentials, tokens or consent.

Practical implication: shift control coverage to the browser session and the identity transaction, not only the endpoint after compromise.

Consent flows and device-code auth bypass normal login assumptions

OAuth device authorization and consent abuse do not behave like conventional password-based login. The user may already have an active browser session, so the attacker is exploiting authorised identity context rather than breaking authentication in the classic sense. That is why these techniques can bypass password resets, MFA prompts and even passkey deployments. The failure mode is not weak login alone, but trust in the authorisation flow itself when the flow is separable from the genuine user intent that should have initiated it.

Practical implication: review OAuth and device-code flows as privilege-granting paths, not just authentication events.

Malicious extensions turn browser trust into persistent identity risk

Browser extensions are now part of the identity attack surface because they can be installed legitimately and later weaponised, bought, or transferred. Once an extension has access to sessions, web content or OAuth-linked activity, it becomes a durable interception point that sits between the user and the application. The article’s example of extension supply chain compromise shows why this matters: the browser itself becomes a long-lived trust broker, and compromise can scale through developer accounts, marketplace trust and ownership changes rather than through one-off malware delivery.

Practical implication: govern extension install, ownership and OAuth permissions as part of browser-layer identity control.

Threat narrative

Attacker objective: The objective is to obtain usable identity state in the browser so the attacker can access SaaS services as the victim and move quickly to data theft or broader tenant compromise.

1. Entry begins in the browser through AiTM phishing, ClickFix, device code phishing, OAuth consent abuse or malicious extension delivery, rather than through tenant exploitation.
2. Credential or session capture follows when the victim enters secrets, authorises an app, or completes a browser-native flow that hands the attacker identity state.
3. Escalation occurs when the attacker reuses the captured session, token or consent to access SaaS applications with the victim's identity.
4. Impact is tenant compromise, data exfiltration, and in some cases multi-tenant breach campaigns driven by reusable identity artefacts.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser-and-identity compromise is now the primary SaaS governance problem, not a side effect of it. The article shows that attacker innovation is concentrated in the access layer, where browser-delivered techniques determine whether compromise reaches the tenant at all. That means SaaS security is no longer mainly about hardening the application surface after login. Practitioners should treat browser-delivered identity capture as the front line of governance.

Consent and device-code flows are trust boundaries, not convenience features. These flows were designed to reduce friction, but attackers have turned them into a way to separate legitimate user presence from legitimate user intent. That is a governance failure, not just an authentication failure. Security teams need to recognise that authorisation pathways can confer access even when credentials never visibly change hands.

Browser extensions are now part of identity infrastructure. The article’s extension examples show that marketplace trust, OAuth linkage and account transfer can turn a tool into a persistent access path. This widens the identity estate beyond users and service accounts to include browser-layer intermediaries. Governance programmes that ignore extension lifecycle are missing an active control plane for session and data exposure.

Identity blast radius now depends on how quickly browser compromise turns into reusable tokens. The article ties infostealer-driven credential supply to credential stuffing and session hijacking, which means one browser compromise can seed the next attack cycle. That is why containment at the point of initial access matters more than retrospective detection. The practitioner takeaway is simple: reduce the duration and reusability of identity artefacts before they become attack fuel.

Assumptions built for static access reviews break when access is created and consumed in-browser. Access review processes were designed for entitlements that persist long enough to be observed, certified and revoked on a cycle. That assumption fails when the decisive event is a browser session, a consent grant or a device-code approval that can be weaponised immediately. The implication is that governance has to move closer to issuance and browser-time control.

What this signals

Browser-time control is becoming the missing layer in identity programmes. Teams that still rely on endpoint telemetry and post-login reviews will keep missing the first compromise event, because the decisive abuse now happens in the browser before SaaS controls even see a risky session. The practical response is to govern consent, device-code and extension pathways as part of the identity control plane.

Identity governance now extends to the browser ecosystem. The matrix makes clear that access does not only live in directories and SaaS admin consoles. It also lives in the browser, where extensions, token reuse and human-in-the-loop phishing reshape how access is created, reused and abused. Programmes that do not account for that layer will keep certifying yesterday's risk while today's compromise unfolds elsewhere.

For practitioners

• Harden browser-layer identity controls Treat the browser as an enforcement point for identity risk. Monitor session theft, OAuth consent grants, device-code prompts and extension behavior together so initial access is visible before a tenant is touched.
• Review OAuth and device-code flows Inventory every workflow that can mint access through consent, device authorization or delegated app trust. Remove unnecessary approval paths and flag flows that let an active browser session become authorization.
• Govern browser extensions as identity assets Track extension install sources, ownership changes, permissions and developer account trust as part of the identity estate. Remove or restrict extensions that can read sessions, pages or authorization prompts.
• Reduce identity artefact reusability Shorten the useful life of stolen tokens and credentials by tightening session controls, reauthentication triggers and token scope. The goal is to make browser-captured identity state less valuable to the attacker.

Key takeaways

• Browser-based initial access now drives much of modern SaaS compromise, which means security teams must move controls closer to the browser and identity transaction.
• Consent abuse, device-code phishing and malicious extensions show that identity attacks can succeed without breaking the login page itself.
• The control gap is no longer just detection after compromise; it is visibility and governance at the moment access is created.

Key terms

• Browser-Based Initial Access: The first compromise step happens through the browser rather than through a server exploit or network intrusion. In this pattern, the browser becomes the delivery and interaction layer for phishing, consent abuse, device-code prompts and extension abuse that produces usable identity state.
• Consent Abuse: Consent abuse occurs when an attacker convinces a user or admin to approve a malicious or overbroad application. The resulting authorization appears legitimate, which makes it harder for password or MFA controls to stop unauthorized data access once the app is approved.
• Device code phishing: An identity attack that abuses the device authorization flow by tricking a user into entering a code on a legitimate login page while the attacker completes the flow elsewhere. It is effective because it relies on a real authentication protocol and can bypass password theft and familiar MFA prompts.
• Browser Extension Supply Chain Risk: The risk that a browser extension, its publisher, or its update channel becomes the entry point for compromise. Extensions can inherit powerful browser and SaaS permissions, so a trusted add-on can become a delivery mechanism for token theft, data access, or silent persistence.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.