No Vulnerability Was Exploited: Inside the SaaS Extortion Wave That Breaks In Through Consent, Not Code

Between mid‑2025 and mid‑2026, a financially motivated extortion group executed the largest documented SaaS consent abuse campaign to date—breaching 1,000+ organizations and claiming 1.5 billion records—by tricking users into granting OAuth consent, stealing vendor‑stored tokens via supply‑chain compromises, and exploiting misconfigured public APIs; the report explains the attack mechanics, why authentication protections like MFA fail, detection signals at the authorization layer, and recommended platform controls and revocation response steps.