I co-authored a new [Unit 42 article](https://unit42.paloaltonetworks.com/current-landscape-oauth-attacks/) examining how attackers abuse OAuth tokens, app consent and redirects to gain access beyond the login screen.
Oct 22, 2026
Device-code phishing campaigns are combining CAPTCHA gates, multi-step SaaS lure chains, encrypted blob-page delivery and source-level text obfuscation to evade automated scanners and reputation checks.
Jul 24, 2026
An active phishing campaign abuses Microsoft's legitimate device-code OAuth flow to capture application tokens instead of passwords. The pages combine trusted sign-in screens with obfuscation, developer-tool detection and debugger traps.
Mar 23, 2026