OAuth and Token Abuse Statistics (2026)

OAuth grants and stolen tokens let attackers walk past passwords and MFA, yet the numbers on how often this happens are scattered across threat intelligence blogs, incident write-ups and vendor reports rather than collected in one place. This page gathers sourced figures on three things: malicious or illicit OAuth application grants, theft and replay of access, refresh and session tokens, and breaches that ran through a trusted SaaS integration. Each figure carries its publisher, report and period in the same sentence or table row, and only pages we read are cited. It is written for identity and SaaS security teams building a business case, and for analysts who need a defensible number rather than a recycled one. For broader SaaS figures, see the SaaS Security Statistics Guide; this page does not repeat them.

Last reviewed: November 2026.

Key takeaways

Token abuse is rare by count but severe by impact. The Microsoft Digital Defense Report 2024 places token theft and consent phishing inside the under 1% of identity attacks that are not password attacks, yet the largest SaaS data thefts of 2025 ran on stolen OAuth tokens.
Integration tokens scale one breach into hundreds. The Cloud Security Alliance counts more than 700 organisations affected by stolen Salesloft Drift tokens and more than 200 Salesforce instances reached through Gainsight-published apps.
Malicious apps are cheap to mass-produce. Microsoft Threat Intelligence found around 17,000 malicious multitenant OAuth applications behind more than 927,000 phishing emails between July and November 2023.
Token replay moves in minutes. Huntress observed 12 minutes, and later four minutes, between a victim reaching an MFA prompt through a relay and the replayed session in a 2026 campaign that hit 79 organisations.
The supply of stolen sessions is enormous. SpyCloud's 2025 Identity Exposure Report recaptured 17 billion stolen cookies and 33.1 million exposed API keys, mostly from 2024 data.

Headline statistics

The table below is the short list most teams need. Figures from incident write-ups describe a single campaign and should not be read as prevalence across all organisations.

Figure	What it measures	Publisher, report and period
~17,000 malicious multitenant OAuth apps	Apps created from compromised accounts to send phishing	Microsoft Threat Intelligence, OAuth misuse blog, July to November 2023
927,000+ phishing emails	Mail sent by those malicious apps	Microsoft Threat Intelligence, same campaign
700+ organisations	Organisations affected by stolen Salesloft Drift OAuth tokens	Cloud Security Alliance research note, July 2026, covering August 2025
200+ Salesforce instances	Instances potentially affected through Gainsight-published apps	Google Threat Intelligence Group analyst quoted by The Register, November 2025; repeated by CSA
195 organisations	Customer organisations whose OAuth tokens were exposed in the Klue intrusion	Cloud Security Alliance research note, July 2026, covering June 2026
21% of cases	Initial access via stolen human and non-human identities in cloud and SaaS incidents	Google Cloud Threat Horizons Report H1 2026, H2 2025 data
21% of cases	Initial access via compromised trusted relationships with third parties	Google Cloud Threat Horizons Report H1 2026, H2 2025 data
17 billion cookies	Stolen session cookies recaptured from criminal sources	SpyCloud 2025 Identity Exposure Report, published March 2025
58% and 46%	Organisations struggling to enforce least privilege across SaaS integrations; lacking visibility into NHIs such as OAuth apps	CSA 2025 to 2026 State of SaaS Security survey of 420 professionals, cited in the CSA research note

Malicious and illicit OAuth application grants

Consent phishing and attacker-registered apps turn a single click on a consent screen into persistent, API-level access that survives a password reset. The figures below come from investigations where the publisher saw the apps directly. For the mechanics and controls, see the Consent Phishing and Illicit OAuth Grants Guide.

Mass app creation: Microsoft Threat Intelligence reported in December 2023 that one actor used compromised accounts to create around 17,000 multitenant OAuth applications, which sent more than 927,000 phishing emails between July and November 2023. Another actor, Storm-1286, created one to three new OAuth apps per compromised account to send spam.
Cost of abuse: In the same report, Storm-1283 used OAuth apps to deploy cryptomining virtual machines, and affected organisations faced compute fees ranging from 10,000 to 1.5 million USD.
App impersonation: Proofpoint reported in July 2025 that it saw over 50 impersonated applications in email campaigns, and that in early 2025 more than two dozen malicious Microsoft OAuth apps were authorised by more than two dozen users across more than 20 tenants, with account takeover evidence in five cases.
Phishing kit success: Proofpoint also observed attempted compromises of nearly 3,000 user accounts across more than 900 Microsoft 365 environments in 2025 from the Tycoon phishing kit linked to these campaigns, with a confirmed success rate above 50%.
Elevated test apps: Microsoft's January 2024 guidance on the Midnight Blizzard attack describes a legacy test OAuth application with elevated access, additional malicious OAuth apps created by the actor, and a grant of the Exchange Online full_access_as_app role used to read mailboxes. See the Microsoft Midnight Blizzard breach.
Volume at one provider: Okta wrote in September 2025 that its own security team had blocked thousands of OAuth integrations seeking access to one of its main productivity platforms. Okta gives no exact count, so treat this as an order of magnitude.

Platform defaults are shifting in response. Okta's article notes Microsoft's plan to stop default user consent for new apps by the end of August 2025 and Salesforce's plan to stop user consent for uninstalled connected apps from the end of September 2025. Confirm the current state in your own tenant; see How to restrict user consent to apps in Entra ID.

Token theft and replay

Token theft covers OAuth access and refresh tokens, browser session cookies and device-bound tokens such as the Entra primary refresh token. Large-scale prevalence data is thin, so most numbers come from single campaigns.

Source and period	Technique	Figures
Huntress, July to September 2026 (published October 2026)	Adversary-in-the-middle relay, token replay and rogue device registration in Microsoft 365	79 victim organisations; at least 497 successful sign-ins; more than 200,000 failed logins; at least 48 rogue Entra devices; stolen token lifetime about 90 minutes
Microsoft, campaign active since August 2024 (published February 2025)	Device code phishing by Storm-2372	Captured access and refresh tokens; later used the Microsoft Authentication Broker client ID to register a device and obtain a primary refresh token
Microsoft Digital Defense Report 2024	All identity attacks seen by Entra	About 600 million identity attacks per day, over 99% password-based; token theft and consent phishing sit in the under 1% remainder
SpyCloud 2025 Identity Exposure Report, mostly 2024 data	Infostealer output	17 billion stolen cookies recaptured; 1 in 2 corporate users exposed through infostealers in the past year
Mandiant M-Trends 2025, 2024 investigations	Stolen credentials as initial infection vector	16% of investigations, second after exploits at 33%; Mandiant links the rise to infostealers

Two timing facts matter for response. Microsoft's 2022 token theft guidance notes that after a refresh token is revoked, an issued access token can remain valid for up to an hour unless continuous access evaluation shortens that window. Huntress measured gaps of 12 minutes and four minutes between a victim reaching the MFA prompt through the relay and the hijacked session, which is faster than most manual triage. See How to detect use of a stolen OAuth refresh token and the Storm-2372 threat actor profile.

SaaS integration token breaches

When an integration vendor stores customers' OAuth tokens, one compromise at the vendor yields access to every connected tenant. The figures below show how far a single token store reaches.

Incident	Tokens involved	Reach and timing	Source
GitHub, April 2022	OAuth user tokens issued to Heroku Dashboard and Travis CI apps (five app IDs)	Private repositories downloaded from dozens of organisations, including npm; an AWS API key found in those repositories gave access to npm infrastructure	GitHub security alert
Salesloft Drift, August 2025	OAuth access and refresh tokens for the Drift Salesforce integration	700+ organisations (CSA); at Cloudflare, attacker activity ran 9 to 17 August 2025, the 17 August export took just over three minutes and 104 Cloudflare API tokens were found in the stolen data and rotated	CSA research note; Cloudflare incident post
Gainsight, November 2025	Tokens for Gainsight-published Salesforce apps	More than 200 potentially affected Salesforce instances	GTIG via The Register; CSA
Klue, June 2026	OAuth tokens held by the integration	Tokens tied to 195 organisations; initial access with a four-year-old dormant test credential; detected the next day	CSA research note

The Google Cloud Threat Horizons Report H1 2026 names the same pattern qualitatively for H2 2025: compromised Drift OAuth tokens, theft and abuse of Gainsight tokens, and stolen GitHub personal access tokens used to reach code repositories. The live breach pages give the detail: the Salesloft Drift breach, the Gainsight Salesforce breach, the Klue OAuth breach and the GitHub OAuth token breach. For lessons across these cases, see OAuth and SaaS integration breaches.

What the numbers mean for defenders

Weight impact, not frequency: a technique in Microsoft's under 1% bucket still produced the multi-hundred-organisation incidents above. Risk registers that rank by count alone will under-invest here.
Treat every integration as a token store: the Drift, Gainsight and Klue figures all trace to tokens held by a third party. Ask vendors where your tokens live, how long they last and how fast they can be revoked.
Old and dormant credentials matter: the Klue intrusion began with a four-year-old dormant test credential, and Midnight Blizzard began with a legacy test tenant and app. Expiry and dormancy review are cheap compared with the reach these numbers show.
Response time is measured in minutes: with replay four to 12 minutes after MFA and access tokens valid for up to an hour after revocation, automated revocation and continuous access evaluation carry more weight than manual playbooks.
MFA alone does not close this gap: every figure on this page describes access gained after or around MFA. Sender-constrained tokens and device binding are the controls aimed at replay; see the DPoP Guide and the Token Lifetime Policy Design Guide.

How to use these statistics in a business case

Start with your own inventory. Count third-party OAuth apps, the scopes they hold and token ages in your main SaaS platforms. External numbers persuade; internal ones get funded.
Pick one prevalence figure and one impact figure. For example, the 21% stolen identity share from Threat Horizons alongside the 700+ organisations reached through Drift tokens.
Quote the period and scope. Say "H2 2025, Mandiant cloud and SaaS engagements", not "21% of breaches". Mixing populations is the most common error in statistics slides.
Map each figure to a control you will fund. Consent restriction, token lifetime limits, integration review, revocation automation or session binding.
Set a baseline and re-measure quarterly. Use the metrics below so the next review shows movement rather than a new set of external figures.
Refresh sources annually. Threat Horizons is half-yearly; M-Trends, the DBIR, the Microsoft Digital Defense Report and the SpyCloud report are annual.

Metrics to track internally

Metric	Why it matters	Typical data source
Third-party OAuth apps with high-privilege scopes, and their owners	Bounds the blast radius shown by the integration breaches above	Entra enterprise apps, Google Workspace app access control, Salesforce connected apps
Share of user consents requiring admin approval	Measures exposure to the consent phishing campaigns above	Consent settings and admin consent request logs
Median and maximum refresh token age per integration	Gainsight and Klue show long-lived and dormant tokens being used	Platform token reports or SSPM tooling
Time from token compromise alert to full revocation	Compare with the four to 12 minute replay gaps and the up to one hour access token tail	SOAR and incident tickets
Sign-ins flagged for token replay or anomalous token use	Shows whether detections fire on the technique at all	Identity protection risk detections, SIEM
Devices registered shortly after risky sign-ins	Huntress and Storm-2372 both show device registration after token capture	Entra audit logs, device registration events

Framework mapping

Finding	MITRE ATT&CK	NIST CSF 2.0	NIST SP 800-53 Rev 5
Illicit consent and malicious apps	T1566.002 Spearphishing Link; T1528 Steal Application Access Token	PR.AA-05	AC-6, AC-2
Stolen integration tokens used against tenants	T1550.001 Application Access Token	GV.SC-07, PR.AA-01	SA-9, IA-5
Session cookie theft and replay	T1539 Steal Web Session Cookie; T1606.001 Web Cookies	DE.CM-01	SI-4, AU-6
Privilege added to compromised apps	T1098.003 Additional Cloud Roles	PR.AA-05	AC-6
Revocation and containment	n/a	RS.MI-01	IA-5

In ISO/IEC 27001:2022 Annex A, the same findings sit mainly under A.5.15 access control, A.5.19 information security in supplier relationships and A.8.16 monitoring activities. In CIS Controls v8.1, see Control 6 (Access Control Management) and Control 15 (Service Provider Management).

Common failure patterns when using these figures

Quoting a campaign as prevalence: 79 organisations or 17,000 apps describe one campaign seen by one vendor, not a share of all tenants.
Mixing "organisations", "instances" and "tokens": Gainsight was reported as more than 200 Salesforce instances and Klue as tokens tied to 195 organisations. These are different units.
Citing claims as facts: the CSA note records ShinyHunters' claim of close to 1,000 organisations as unverified. Do not put unverified actor claims in a board slide.
Using a 99% password figure to dismiss token risk: the Microsoft figure measures attack volume, not breach impact, and the integration incidents above show the opposite weighting.
Dropping the period: the Threat Horizons shares are for H2 2025 and the M-Trends figure for 2024. Undated figures age badly and get challenged.
Relying on roundup pages: secondary statistics sites often misquote units and periods. Trace every number back to the publisher, as this page does.

Methodology notes and caveats

Figures were taken only from the publisher's own page or, for one incident count, from a named analyst quoted by a news outlet. Vendor figures (Huntress, Proofpoint, SpyCloud, Okta) reflect each vendor's customer base and telemetry. The Microsoft Digital Defense Report 2025 page could not be read when this page was compiled, so the 2024 figures are used. Incident counts such as "700+ organisations" are lower bounds reported during or shortly after the investigation and may have changed since.

Practitioner checklist

Inventory third-party OAuth apps and integrations in every major SaaS platform, with scopes, owners and token age.
Restrict user consent to verified publishers and low-risk scopes, and route the rest through admin approval.
Set maximum token lifetimes and remove dormant integrations and test apps.
Ask each integration vendor where your tokens are stored, how they are protected and how fast they can be revoked.
Turn on continuous access evaluation or the equivalent where your identity provider supports it.
Alert on device registration and new MFA methods shortly after risky sign-ins.
Automate token and session revocation from your SOAR when an integration or user is suspected compromised.
Report the six internal metrics above quarterly, quoting external figures only with publisher and period.

OAuth and Token Abuse Statistics: Sourced Figures on Grants, Theft and Integration Breaches