The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed

This article warns that persistent OAuth grants (long-lived refresh tokens) are an under-monitored attack vector that bypass perimeter controls and MFA; it cites the Drift incident where UNC6395 used stolen OAuth tokens to access Salesforce environments across 700+ organizations and exfiltrate sensitive data, and recommends continuous behavioral monitoring, blast-radius risk scoring, and automated remediation (Material Security's OAuth Threat Remediation Agent) to detect and revoke high-risk grants.