Push Security Uncovers "ConsentFix": A New Class of Browser-Native Phishing Attack

BLACK HAT, EUROPE -- (Booth #305) -- Push Security, a leader in browser-based detection and response, today announced the discovery of a new class of phishing attack that enables Microsoft account ...

New ConsentFix attack hijacks Microsoft accounts via Azure CLI

A new variation of the ClickFix attack dubbed 'ConsentFix' abuses the Azure CLI OAuth app to hijack Microsoft accounts without the need for a password or to bypass multi-factor authentication (MFA) ...

If You Get This Message, Your Microsoft Account Is Under Attack

Check Point explains that this new technique “tricks people into giving attackers access to their Microsoft accounts. The ...
Security

Salt Security enhances API security platform with OAuth protection package

PALO ALTO, Calif., April 25, 2024 -- Salt Security today announced the release of its new multi-layered OAuth protection package to detect attempts to exploit OAuth and proactively fix vulnerabilities ...
CSOonline

Salt Security adds defense against OAuth attacks

Salt Security has added a new OAuth security offering to its API protection platform to help organizations detect attempts to exploit OAuth and fix vulnerabilities associated with the protocol. OAuth ...
Geeky Gadgets

Creating custom GPTs with OAuth Authentication for improved security

Designing custom Generative Pre-trained Transformers (GPTs) and adding OAuth Authentication is a big step for anyone who want to improve their custom GPTs. This integration makes it possible to create ...
Computer Weekly

Salt Labs identifies OAuth security flaw within Booking.com

Critical security flaws in Booking.com’s implementation of Open Authorization (OAuth) could have enabled attackers to launch large-scale account takeovers, putting millions of people’s sensitive ...
Ars Technica

Compromising Twitter’s OAuth security system

Twitter officially disabled Basic authentication this week, the final step in the company’s transition to mandatory OAuth authentication. Sadly, Twitter’s extremely poor implementation of the OAuth ...