Attackers Target OAuth Tokens to Bypass MFA and Password Resets

Cybersecurity researchers at Unit 42 reported on October 22, 2026, that attackers are shifting their focus toward stealing Open Authorization tokens as organizations adopt multi-factor authentication. These stolen tokens grant access to applications without requiring user passwords. [1]

Unit 42 stated that adversaries are accelerating these token attacks by employing dynamic evasion code, phishing-as-a-service templates, and large language model brand impersonations. Because these attacks occur at the authorization layer after user authentication, stolen access and refresh tokens bypass multi-factor authentication controls. [1]

OAuth is an open standard for access delegation that allows users to grant third-party applications access to their information without sharing passwords. Major companies including Amazon, Google, Meta Platforms, Microsoft, and Twitter use the mechanism to allow secure information sharing across accounts. [3]

According to Unit 42, token-based attacks survive standard password resets, allowing attackers to maintain durable authorization. Organizations are advised to implement protective measures at the authorization layer to secure their cloud environments against modern OAuth threats. [1]