He (Shawn) Shuang | ๅŒๅฃ‘
  • Home
  • Publications
  • News
  • Fun
  • Recent & Upcoming Talks
    • Example Talk
  • Fun
  • News
    • The Current Landscape of OAuth Attacks
    • Phishing Pages Hosted on AI-based Site Builders
    • Plaintext Credentials in Public Repositories
    • Agent Tripwire: Detecting Misbehaving AI Agents at Runtime
    • Device Code Phishing Evasion Techniques
    • Device Code-based OAuth Phishing
    • IOCs for tech support scam activity
    • IOCs for phishing pages using blob URLs
    • IOCs for phishing campaign using BitM pages
  • Publications
    • (2025). Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector.
    • A Survey of Hardware Improvements to Secure Program Execution
    • vWitness: Certifying Web Page Interactions with Computer Vision
  • Projects
  • Blog
    • ๐ŸŽ‰ Easily create your own simple yet highly customizable blog
    • ๐Ÿง  Sharpen your thinking with a second brain
    • ๐Ÿ“ˆ Communicate your results effectively with the best data visualizations
    • ๐Ÿ‘ฉ๐Ÿผโ€๐Ÿซ Teach academic courses
    • โœ… Manage your projects
  • Projects
    • Pandas
    • PyTorch
    • scikit-learn
  • Experience
  • Teaching
    • Learn JavaScript
    • Learn Python

The Current Landscape of OAuth Attacks

Oct 22, 2026 ยท 1 min read
Go to Project Site

I co-authored a new Unit 42 article examining how attackers abuse OAuth tokens, app consent and redirects to gain access beyond the login screen.

Last updated on Oct 22, 2026
Phishing OAuth Web Security
He (Shawn) Shuang
Authors
He (Shawn) Shuang
Web Security Researcher
Phishing Pages Hosted on AI-based Site Builders Oct 21, 2026 →

ยฉ 2026 Me. This work is licensed under CC BY NC ND 4.0

Published with Hugo Blox Builder โ€” the free, open source website builder that empowers creators.