Russian threat actors have been abusing legitimate OAuth 2.0 authentication workflows ... The researchers simplified in the following diagram the attack flow targeting users by relying on a ...

The relevant campaigns were detected by Proofpoint, and target Outlook Web Access, PayPal, Microsoft ... OAuth apps, developers are given the freedom to select among various available flow types ...