Resetting Your Password Won’t Stop Hackers Exploiting OAuth Flaw for Permanent Access

• Attackers are increasingly exploiting OAuth apps for long-term unauthorized access.
• Access persists despite password resets and MFA enforcement.
• Proofpoint researchers have confirmed these attacks in the wild.

Cybersecurity researchers from Proofpoint have identified a dangerous new strategy in which threat actors are exploiting OAuth applications to gain continuous access to compromised cloud environments. This method allows attackers to retain control over accounts even after the legitimate user changes their password or enables MFA.

Once inside a victim’s cloud environment, attackers can authorize internal applications with elevated permissions, allowing them to bypass security controls, access sensitive files, and monitor internal communications. This makes the attack particularly dangerous because even traditional remediation methods — such as password resets — fail to fully remove the intruder.

Cloud Account Takeover on the Rise

Cloud Account Takeover (ATO) techniques have seen a sharp rise in recent years, with cybercriminals exploiting them to steal confidential data, deploy ransomware, and conduct secondary attacks. These attacks are growing not only in number but also in sophistication, as adversaries adapt their strategies to exploit enterprise cloud ecosystems.

Proofpoint’s findings underscore that attackers are no longer relying on single-use credentials; instead, they’re using OAuth’s authorization mechanisms to establish long-term control. This makes the exploitation of OAuth applications one of the most pressing security issues for cloud administrators today.

Persistent Access Explained

To demonstrate the impact of this vulnerability, researchers created a proof-of-concept attack where a malicious program automatically generated and authorized harmful internal apps within a compromised cloud environment. These apps granted attackers continuous access to accounts — even after security measures like MFA or password resets were applied.

In one real-world case, researchers detected a successful login attempt linked to a potential Adversary-in-the-Middle (AitM) social engineering attack. According to Proofpoint’s threat intelligence team, the user’s password was changed four days later, followed by failed login attempts from a Nigerian residential IP address, suggesting the attacker’s likely origin.

However, despite the password change, the malicious OAuth application remained fully functional — providing an alarming example of how resilient this attack method can be. This case demonstrates that such threats are not theoretical but are already being actively exploited by cybercriminals worldwide.

How to Mitigate OAuth Exploitation

Security experts warn that revoking app permissions manually is currently the only reliable way to cut off attacker access before the secret credentials expire — which can take up to two years. Regular monitoring of connected apps and permissions is therefore critical.

Experts emphasize that organizations must implement robust OAuth governance policies and actively track permission scopes granted to applications. Companies using cloud services like Microsoft 365, Google Workspace, or AWS should ensure that their administrators regularly review app consent logs and restrict unnecessary API privileges.

Conclusion

The exploitation of OAuth applications for persistent access represents a serious shift in cyberattack methodology. As traditional security measures like password resets and MFA become less effective against this technique, proactive monitoring and manual permission management are essential. Proofpoint’s findings make it clear: without vigilant oversight, hackers can maintain long-term, undetected control of cloud environments — even after victims think they’ve locked them out.