Zombie Tokens: How OAuth Vulnerabilities Bypass Google Workspace MFA

Cybersecurity is witnessing a fundamental shift in how Google Workspace is compromised, moving away from traditional phishing toward the exploitation of stolen OAuth tokens. Material Security has identified a new attack chain where hackers target the identity layer to bypass multi-factor authentication (MFA) and maintain persistent access to enterprise data.

In a recent high-profile breach, attackers compromised Context.ai, a third-party AI vendor, to steal an OAuth token. This token allowed the threat actors to pivot directly into a Vercel employee's Google Workspace account. Once inside the Workspace environment, the attackers leveraged that access to move further into Vercel's internal production environments. A similar vulnerability was exposed in the Composio breach, where a single compromised Gmail OAuth token enabled the exfiltration of more than 10,000 customer credentials.

The Rise of OAuth Sprawl

Historically, Google Workspace security focused on the "front door," prioritizing the protection of login credentials and the implementation of MFA to stop unauthorized entry. However, the rapid adoption of AI agents and third-party integrations has expanded the attack surface. Many organizations now suffer from "OAuth sprawl," a condition where dormant applications retain high-level permissions to sensitive Gmail and Drive data long after their primary utility has ended.

These permissions are managed via refresh tokens, which are designed to be long-lived. These refresh tokens can persist and allow access even after password changes or MFA implementation, as they bypass the primary authentication flow. This creates a "zombie token" effect where the attacker's access remains active regardless of standard security hygiene, allowing a usable session to persist even if the user logs out or leaves the company entirely.

A New Supply-Chain Blind Spot

This shift represents a critical evolution in supply-chain attacks. Because OAuth tokens bypass the primary authentication flow, they render MFA ineffective once the token is stolen. Security teams often operate under the false assumption that a password reset or a forced logout will terminate all active sessions, but these identity-layer tokens exist outside that mechanism.

As enterprises integrate more AI tools that require deep access to Workspace data to function, the risk increases. A single compromise at a small AI vendor can now lead to a full enterprise takeover, as the token provides a direct, authenticated path into the heart of a company's communications and document storage.

What to Watch

Security professionals are now urged to move beyond credential management and begin auditing OAuth permissions. The primary challenge remains visibility; many organizations lack a centralized way to track which third-party apps hold persistent tokens and what specific scopes they can access. Until enterprises implement stricter token expiration policies and continuous permission auditing, the identity layer will remain a primary target for sophisticated actors.