Saas Security - GoKawiil

Report: browser-based SaaS attacks slip past EDR tools, NordLayer finds

NordLayer, citing its Browser Security Report 2026, says attackers increasingly compromise SaaS accounts via browser sessions—OAuth token theft, adversary-in-the-middle phishing, malicious extensions—without triggering endpoint detection and response (EDR) alerts because no malicious process or executable touches the host. It cites the 2025 Salesloft Drift breach, where group UNC6395 used stolen OAuth tokens to pull data from Salesforce via API calls, and a 2026 Microsoft-tracked campaign by Storm-2755 using search ads to phish Canadian employees. NordLayer's report found browser access present in all 504 reviewed applications, with 79% accessible only via browser.

bleepingcomputer.com · 2026-10-02

OAuth Consent Grants Emerge as Blind Spot Bypassing MFA in SaaS Attacks

Security researchers warn that attackers can gain lasting access to SaaS and cloud accounts simply by tricking a logged-in user into approving a malicious OAuth application, sidestepping passwords, malware, and multifactor authentication entirely. Once granted, these app permissions can let attackers read email, browse files, pull source code, or touch CI/CD systems through legitimate API access until the tokens or grants are revoked.

darkreading.com · 2026-09-18