TL;DR

• OAuth/SaaS token abuse drives multi-tenant data theft; one OAuth supply-chain event impacted hundreds of organizations.
• Browser extensions and session cookies enable “MFA‑quiet” persistence at scale.
• Collaboration/BEC attacks are moving into chat and workflow platforms (Teams/Slack/Zoom); SEG bypass is now routine.
• AI-scaled lures and AiTM proxies accelerate dwell‑to‑cash; behavior analytics outperform IOCs.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Quantified Trends, Examples, Impact, Detections

Identity-first intrusions: OAuth consent/device flows, SaaS token replay

• Baselines/examples:
  • Salesforce campaign via Salesloft/Drift OAuth tokens impacted hundreds of organizations; tokens reused for data theft; Workspace email access at a “very small number” (Aug 2025) ([refs 1,2,5]).
  • Multiple IR briefs cite OAuth grants enabling non-interactive access that survives MFA/password resets ([refs 5,6,9]).
• Impact: Long-lived Mail/Files/CRM access; SaaS-to-SaaS lateral movement via multi-tenant apps.
• Sample detections:
  • Alert: new multi-tenant app with offline_access + Files.ReadWrite.All/Mail.ReadWrite; publisherDomain change; spike in non-interactive API calls from new app ID within 60 minutes.

Browser-as-control-plane: extensions/session exfiltration

• Baselines/examples:
  • “ShadyPanda” campaign amassed ~4.3M installs across Chrome/Edge extensions, exfiltrating data (Dec 2025) ([refs 7,8]).
  • Reports highlight cookie/session theft and actively exploited Chrome vulnerabilities used in the wild ([refs 10,11]).
• Impact: Persistent SaaS access via cookie replay; stealthy exfiltration paths outside EDR.
• Sample detections:
  • Alert on extension permission/publisher change + first-seen outbound domain + SaaS login without MFA challenge from existing device profile.

Collaboration-platform phishing and BEC-in-workflow

• Baselines/examples:
  • Continued abuse of inter-tenant collaboration and workflow bots; Teams disruptions (Oct 2025) ([ref 3]).
  • Phishing kits pivot into Google Workspace/Calendly-themed flows and OAuth abuse ([refs 4,12]).
• Impact: Payment reroutes inside approval chains; mailbox rules + OAuth grants + chat lures.
• Sample detections:
  • Alert: first-time external tenant chat DM + mailbox rule creation + new OAuth grant within 24–48 hours; Slack/Zoom: first external app install + webhooks to finance channels.

AI-augmented lures + AiTM

• Baselines/examples:
  • High-variance, localized lure waves; QR-in-PDF leading to AiTM proxies across ecosystems ([refs 4,6,12]).
• Impact: Faster scale/iteration; resilient to template/IOC blocking.
• Sample detections:
  • Heuristic: QR-in-PDF + external redirect + domain age <30 days + headless/browser automation signals.

AlphaHunt Converge - Plug in your Flight Crew

Get intelligence where it counts. No dashboards. No detours. AlphaHunt Converge teases out your intent, reviews the results and delivers actionable intel right inside Slack. We turn noise into signal and analysts into force multipliers.

Anticipate, Don’t Chase.

Plug it In!

30/60/90-Day Plan (Owners, SLAs, KPIs)

30 days

• Owners: IdP/SaaS Security, Browser/Endpoint, SecOps.
• Actions:
  • Enforce admin consent for unverified/multi-tenant apps (Entra/Workspace/Okta); disable device code where not needed.
  • Extension allow-list; block high-risk permissions (cookies, webRequest, tabs); manage browser profiles.
  • Detections: OAuth toxic-scope grants; extension drift; inter-tenant chat + rule + grant triad.
• SLAs/KPIs:
  • SLA: Revoke risky grants and kill sessions ≤2h of alert.
  • KPIs: ≥95% apps require admin consent; ≤24h MTTD for extension drift; ≥90% managed browsers enrolled.

60 days

• Owners: IdP/SaaS Security, SecEng, Finance Ops.
• Actions:
  • Continuous Access Evaluation + short-lived tokens; token binding where supported.
  • Finance safeguards: payee-change holds, callback verification; rollback playbooks.
  • SaaS app governance: alert on publisher/permission changes; block legacy device flows.
• SLAs/KPIs:
  • SLA: OAuth grant review turnaround ≤24h.
  • KPIs: ≥80% tokens ≤1h TTL where supported; ≥95% finance changes verified OOB.

90 days

• Owners: Threat Intel, Detection Eng, GRC.
• Actions:
  • Behavior models: anomalous non-interactive API bursts, headless/AiTM infrastructure, SaaS-to-SaaS lateral movement.
  • Red-team exercise: consent-phish + browser token theft + BEC-in-workflow.
  • Vendor/tenant trust program for collaboration federation.
• SLAs/KPIs:
  • SLA: Contain BEC-in-workflow attempts ≤4h to prevent payout.
  • KPIs: ≥50% reduction in toxic-scope dwell time; ≥30% drop in external app installs without review.

Suggested Pivots, References, etc.

(Members only, SIGN UP!)