Unit 42's Oct 22 review of OAuth attacks describes three patterns: account hijacking (device-code phishing and authorization codes copied out of real apps' redirects), permission hijacking (consent to vaguely named or brand-impersonating apps) and malicious redirects (deliberately triggered OAuth errors that bounce victims from a real IdP to an attacker page). It also notes phishing-as-a-service templates and LLM-built lure pages.

• Consent: disable end-user consent for third-party apps and route requests through an admin-consent workflow. Review existing grants for vague names ("Security App") and broad mail/file scopes.
• Redirects: keep an inventory of registered apps and their redirect_uri values, and quarantine any that point at new or unmanaged domains.
• Device code: block the device-code flow by Conditional Access except for the accounts and devices that need it.
• Response: a password reset doesn't kill refresh tokens. Revoke sessions and remove the app's grant as well.
• New consent surfaces: developer platforms now issue OAuth tokens too. Unit 42 cites Cloudflare's self-managed OAuth clients, where a malicious grant could touch DNS and edge code.