Pawn Storm Abuses OAuth In Social Engineering Attacks

This blog post discusses how Pawn Storm abused Open Authentication (OAuth) in advanced social engineering schemes. High profile users of free webmail were targeted by campaigns between 2015 and 2016.

TrustedSec Practical OAuth Abuse for Offensive Operations – Part 1

Pawn Storm Abuses OAuth In Social Engineering Attacks

Social Engineering Attacks: What You Need to Know

DEF CON 29 - TIB AV-Portal

Ontological Model of a Social Engineering Attack [in accordance with 10].

Salt Labs Oh-Auth - Abusing OAuth to take over millions of accounts

Pawn Storm's Lack of Sophistication as a Strategy

APT28 hacked Roundcube email servers of Ukrainian entities

APT Archives - Page 91 of 94 - Security Affairs

Detection and Mitigation of Illicit Consent Grant Attacks in Azure AD - Thomas Naunheim

Microsoft Warns of Hackers Exploiting OAuth for Cryptocurrency Mining and Phishing

What is Social Engineering?

Oauth Token Stealing - Red Team Blog

Russian cyber attack campaigns and actors

What is a Social Engineering Attack?