Attackers abuse OAuth (used in “Sign in with Google/Microsoft”) by tricking users into granting malicious apps access to their accounts.
Why it matters:
- No password theft required — users approve the access.
- Attacker access persists until the token is revoked.
Pro tip: Regularly review and revoke third-party app permissions in your account settings.
Synonyms:
Token Theft