Intelligence briefFall/Winter 2026/2027 Edition
OAuth data theft can survive a password reset
The FBI's September consent-phishing warning and the earlier Drift breach expose two routes to SaaS data theft. Review app permissions, revoke unauthorized grants, and investigate the data already accessed.
At a glance
BA-02 · Breach analysis
- 2 Access paths separated in this brief
- Sep 1 2026 FBI consent-phishing warning[1]
- Status
- Ongoing risk. November 3 review of dated consent-phishing and integration-theft evidence.
- Recent warning
- FBI consent-phishing PSA, September 1, 2026[1]
- Historical incident
- Drift-associated Salesforce data theft, August 2025[2]
- Consent route
- A malicious app receives user-approved permissions[1]
- Integration route
- Previously trusted OAuth tokens are compromised[2]
- Investigation scope
- Granted permissions, connected systems, accessed records[2]
- Response ownership
- Application administrators and incident responders[3]
What happened
September 2026 FBI guidance and the August 2025 Drift breach illustrate distinct SaaS access risks, reviewed here November 3. [1][2]
- The FBI describes deceptive messages leading to a legitimate consent screen, where a malicious app receives permissions without obtaining the user's password. [1]
- Google tracked Drift-token misuse against Salesforce during August 8 through August 18, 2025, without a core Salesforce vulnerability. [2]
- Google expanded the affected integration scope on August 28, 2025. That historical update is not evidence of a fresh November incident. [2]
- Cloudflare's September 2, 2025 disclosure describes stolen Salesforce support-case text and a response that re-established integrations with new secrets. That experience shows why incident scope includes information copied into support conversations. [5]
How it works
The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.
- entry
- next step
- impact
Read the attack chain
The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
November 3 review of dated consent-phishing and integration-theft evidence.
Consent phishing wins new app permissions. Integration theft takes existing service credentials. Triage them as separate hypotheses. [1, 2]
Access follows the app's permissions and the compromised connection. Microsoft administrators can review both user and administrator consent records. [3]
In the Drift campaign, Google observed data exports and searches for credentials inside the stolen material. A support record can therefore become a route to another environment. [2]
The FBI warns that password changes do not remove the malicious grant. Responders must address app authority separately. [1]
The FBI warning and the Drift incident involve different victim populations. Their shared lesson applies wherever a cloud app can read valuable records.
- entry
- next step
- impact
Tap a node to read its story.
Step by step
-
Exercise the granted permissions
Access follows the app's permissions and the compromised connection. Microsoft administrators can review both user and administrator consent records. [3]
-
Read and export business records
In the Drift campaign, Google observed data exports and searches for credentials inside the stolen material. A support record can therefore become a route to another environment. [2]
-
Leave access after the reset
The FBI warns that password changes do not remove the malicious grant. Responders must address app authority separately. [1]
Who is at risk
The FBI warning and the Drift incident involve different victim populations. Their shared lesson applies wherever a cloud app can read valuable records.
- Prominent people and their contacts targeted by deceptive messages. [1]
- Businesses with customer data reachable through SaaS integrations. [2]
- Teams that paste credentials or sensitive configuration details into support cases. [5]
Sectors in scope
- Organizations using email, file-sharing and CRM SaaS
- Executives and other prominent individuals
- Support and sales teams with third-party integrations
What changed since the last edition
Fall/Winter 2026/2027 Edition3 changes
-
September 1, 2026: the FBI published a warning about consent phishing observed since late 2025. This is the recent advisory driving this review.
Source 1 -
August 2025: Google expanded the historical Drift advisory beyond Salesforce integration exposure.
Source 2 -
Current Microsoft administration guidance distinguishes tenant-wide administrator consent from per-user grants and explains their different revocation methods.
Source 3
What to do now
In priority order, highest impact first.
-
Do firstRestrict user consent and establish a reviewed approval route.
Microsoft documents policy controls for user consent; evaluate the permissions and business need before approving an app. [4]
-
Inventory app grants with an owner and a business purpose.
Review both user-consented and administrator-consented permissions, including grants that exceed what the application needs. [3]
-
Revoke unauthorized grants using the supported method.
Microsoft notes that per-user grants cannot be revoked through the administrator portal's User consent tab; use its documented Graph or PowerShell path with an authorized administrator. [3]
-
Contain the compromised integration and rotate relevant secrets.
Cloudflare disconnected and securely re-established integrations during its response; coordinate changes with service owners to preserve necessary business workflows. [5]
-
Investigate the records and systems the connection could reach.
Google recommends examining connected systems; preserve relevant logs and scope credential exposure in exported records. [2]
-
Confirm containment before calling the incident closed.
Z7 recommends an authorized access check and follow-up log review to verify the unwanted app authority has ended. [3]
Indicators
Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.
Sources
Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.
- [1] Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (opens in a new tab) FBI Internet Crime Complaint Center · September 1, 2026 · ic3.gov
- [2] Widespread Data Theft Targets Salesforce Instances via Salesloft Drift (opens in a new tab) Google Threat Intelligence Group · August 26, 2025; updated August 28, 2025 · cloud.google.com
- [3] Review permissions granted to enterprise applications (opens in a new tab) Microsoft · Updated March 6, 2025; reviewed November 3, 2026 · learn.microsoft.com
- [4] Configure how users consent to applications (opens in a new tab) Microsoft · Updated June 24, 2025; reviewed November 3, 2026 · learn.microsoft.com
- [5] The impact of the Salesloft Drift breach on Cloudflare and our customers (opens in a new tab) Cloudflare · September 2, 2025 · blog.cloudflare.com
What does this mean for your security?
Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.