To help developers avoid accidentally doing this, it’s best to make the client secret visually different from the ID. This is the only way to ensure the developer won’t accidentally include it in their application. At this point, you’ve built the application registration screen, you’re ready to let the developer register the application. Therefore, it is crucial for developers to stay updated on security best practices and follow established guidelines for secure implementation.
Malware with appropriate permissions can read these storage locations, exfiltrating tokens to attacker-controlled infrastructure. Instead, they https://otofast.info/automotive-industry-news-navigating-the-fast-lane-of-auto-industry-updates.html wait for the victim to solve it, then steal the session tokens issued as a result. This MFA bypass attack defeats phishing-resistant authentication because the victim actually completes legitimate MFA. The victim successfully logs in, completely unaware their session tokens were stolen in transit. The attacker captures the tokens, then forwards them to the victim’s browser.
Securing AI agent API interactions requires specific protocols beyond traditional application security. The Icarus group is specifically targeting tokens with broad scopes that include api, refresh_token, and offline_access permissions, enabling long-term, persistent access to victim environments. The victim is served a page which requires that they verify that they are human by pasting a URL into the phishing page. Lure variants in the campaign impersonated construction bid solicitations, DocuSign document sharing notifications, voicemail delivery alerts, Microsoft Forms prompts, and shared file reminders incorporating victim organization branding derived from publicly available sources. Affected sectors included construction, nonprofit organizations, real estate, manufacturing, financial services, healthcare, legal services, and local government. The attacker then crafts a phishing message directing the victim to microsoft.com/devicelogin and presenting the user_code as if it were a one-time password, an access code for a shared document, or a security verification token.
What Are the Real Security Risks in MCP Token Handling?
If the user is already logged in (which they likely are if working in their normal browser) their account information is already pre-populated and they won’t need to authenticate again. ConsentFix is an attack technique that prompts the victim to share an OAuth authorization code with an attacker via a phishing page. Unauthorized OAuth consents and device registrations are frequently left in place long after incident remediation because they fall outside standard user account review workflows. Traditional phishing awareness content that emphasizes URL inspection, sender domain verification, and certificate checking does not address this attack, because every element of the authentication interaction occurs on legitimate Microsoft infrastructure. Monitoring for the X-Antibot-Token header and the /api/device/start endpoint pattern at the network layer, where proxy or CASB visibility permits, may identify phishing infrastructure that has not yet been publicly catalogued. Conditional Access policies requiring device compliance or Hybrid Azure AD Join status add a meaningful barrier even when token theft occurs, since the attacker’s system is unlikely to satisfy device compliance requirements for subsequent access attempts using stolen tokens.
- Mix-up attacks can occur in scenarios where an OAuth client interacts with two or more authorization servers and at least one authorization server is under the control of the attacker.
- This then creates an OAuth connection between the victim’s Microsoft account and the attacker’s Azure CLI instance.
- This independence makes OAuth token theft particularly valuable to attackers establishing long-term access.
- In any OAuth flow, the user must approve the requested access based on the scope defined in the authorization request.
The gateway transforms local MCP servers into managed enterprise services with one-click deployment, OAuth protection, and comprehensive audit trails. MintMCP Gateway delivers production-ready MCP infrastructure with SOC 2 Type II compliance for its MCP gateway platform. AI agents now operate with extensive system access—reading files, executing commands, and accessing production systems through MCP tools. We analyzed 45+ solutions across certification status, performance benchmarks, integration breadth, and real-world deployment evidence. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. There’s no pop-up to re-check MFA when an OAuth token is used.
Growing alert volumes overwhelm security teams
- Afterwards, the website initiates an authorization request that is very similar to the one in the attack on the code flow.
- This measure contributes to the prevention of leakage of authorization codes and access tokens (see Section 4.1).
- This guide is about identity tokens (the OAuth and OIDC kind), what each stage of the lifecycle requires, and how to handle the parts that go wrong in production.
- When asymmetric cryptography for client authentication is used, authorization servers do not need to store sensitive symmetric keys, making these methods more robust against leakage of keys.¶
- Network attackers that additionally have full control over the network over which protocol participants communicate.
- Concurrent with Microsoft’s disclosure, the threat intelligence firm Volexity published findings linking at least two additional Russia-affiliated clusters — tracked as UTA0304 and UTA0307 — to the same technique, suggesting independent parallel development or knowledge-sharing within the Russian intelligence community .
When security teams discover a compromise, standard response procedures include forcing password resets, requiring MFA re-enrollment, and terminating active sessions. The victim clicks „Authorize,“ completing whatever MFA challenges their organization requires. Microsoft documented widespread AiTM campaigns throughout 2024 and 2025, targeting organizations across https://www.e-lib.info/getting-to-the-point-7/ industries.
Other Recommendations¶
- When using PKCE, clients SHOULD use PKCE code challenge methods that do not expose the PKCE verifier in the authorization request.
- If compromised, they can provide attackers with persistent access that is difficult to detect than activity originating from standard user accounts.
- After entering an approved email address, the next stage was loaded, prompting the victim to complete a set of instructions on the page to continue.
- It’s not standard practice yet, but it’s the direction the MCP security community is moving.
- For both defenses, clients MUST store, for each authorization request, the issuer they sent the authorization request to and bind this information to the user agent.
To be effective, CSP must be used on the authorization endpoint and, if applicable, other endpoints used to authenticate the user and authorize the client (e.g., the device authorization endpoint, login pages, error pages, etc.). In addition to those, authorization servers SHOULD also use Content Security Policy (CSP) level 2 W3C.CSP-2 or greater.¶ Multiple countermeasures are described in RFC6819, including the use of the X-Frame-Options HTTP response header field and frame-busting JavaScript. A user believing to interact with that context, for example, by clicking on buttons, inadvertently interacts with the authorization endpoint user interface instead.
If a domain not on the target list was provided, the victim was passed back to the original website and the attack did not progress to the next stage. In all of the examples we saw, the victim accessed a malicious or compromised webpage via Google Search. Authorization code flow is an OAuth 2.0 protocol for web applications to get a user’s permission to access protected resources. This then creates an OAuth connection between the victim’s Microsoft account and the attacker’s Azure CLI instance.
