Topic starter
11/08/2026 3:11 pm
TL;DR: Identity compromise in Scattered Spider-style attacks is dominating roughly 70% of browser and identity-related breaches, while device code phishing, OAuth supply chain abuse, and AI-assisted phishing kits are spreading fast across SaaS and cloud access paths, according to Push Security. The real shift is that attackers now industrialize familiar identity abuses faster than IAM and browser controls can adapt.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Browser threat landscape: mid-year update 2026”.
Key questions
Q: What breaks when device code phishing is not separately governed?
A: MFA can still fail if the user is tricked into approving a legitimate device authorization request.
Q: Why do OAuth tokens increase lateral movement risk in SaaS environments?
A: OAuth tokens increase lateral movement risk because they can remain valid after the initial user session, bypass MFA, and preserve scoped access until revoked.
Q: What are the signs that phishing has moved from opportunistic to industrialised?
A: Look for frequent kit reuse, fast-changing infrastructure, overlapping lures across campaigns and the same social engineering pattern appearing in many incidents.
Practitioner guidance
- Harden device code approval paths Block or challenge device authorization requests that originate from untrusted contexts, and treat code entry as a privileged approval event rather than a routine login step.
- Inventory and review OAuth grants List third-party SaaS applications with consented access to production data, then retire grants that are no longer required or that exceed the business need.
- Detect browser-level phishing behaviour Use behavioural detection for redirect chains, clipboard injection, fake login flows and consent prompts instead of relying on domains and hashes alone.
Bottom line: The article describes a threat market where social engineering, browser compromise and token abuse are converging into a repeatable access model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:26 pm
Identity abuse has become an industrialised delivery model, not a one-off intrusion pattern. The article shows that the same social-engineering playbook is now being copied by criminal groups and adopted by others because it consistently produces access. That means identity teams are no longer dealing with isolated technique choice, but with a repeatable service model that turns human trust into scalable access. The practitioner consequence is simple: control design has to assume industrial reuse of identity attacks, not rare exception handling.
A question worth separating out:
Q: How should teams respond when help desk resets become part of the attack chain?
A: Treat account recovery as an access control surface, not a support task. Separate identity proofing from reset approval, require stronger verification for privileged accounts, and review whether passkey enrollment or MFA re-registration can be abused as a persistence step.
👉 Read our full editorial: AI-augmented phishing and OAuth abuse are reshaping identity risk