TL;DR: On July 15, 2026, Nudge Security launched agentic capabilities that continuously inventory, risk-score, and (with human-in-the-loop approval) revoke high-risk OAuth grants and browser extensions across an organization's SaaS estate. The product-launch cadence is downstream of a live threat: the ShinyHunters Salesforce OAuth-abuse campaign disclosed by Microsoft Threat Intelligence on July 13 (200+ tenants affected including Google, Chanel, Pandora), the Salesloft Drift OAuth-token breach cascading into hundreds of Salesforce customers, and the Vercel-Context.ai incident where a single stolen OAuth token from an AI browser extension gave attackers keys to an entire cloud platform's customer base. Every one of those attack paths is now available to a mid-tier ransomware operator targeting NC SMBs. Traditional identity controls (MFA, conditional access, SSO) do not stop them, because OAuth consent bypasses MFA by design.
Key takeaway: The 2026 SaaS breach entry point is not "attacker guessed the password" or "attacker got past MFA." It is "user granted OAuth consent to a malicious app dressed up as a legitimate integration, and the app now has API-level access to every message, file, and object in the account." Password MFA does not defend it. Identity governance does.
Does your NC SMB run Microsoft 365, Google Workspace, Salesforce, HubSpot, or any SaaS with OAuth-connected apps? Contact Preferred Data Corporation for a SaaS identity governance assessment including OAuth grant inventory, browser extension review, admin-consent workflow rollout, and Salesforce-style vishing defense. BBB A+ rated. Call (336) 886-3282.
What Did Nudge Security Announce and Why Now?
Nudge Security announced agentic capabilities on July 15, 2026 that continuously analyze OAuth grants and browser extensions across an organization's SaaS estate, flag high-risk items, and automate remediation with human-in-the-loop decision points.
Three concrete facts every NC SMB should absorb:
- OAuth grants and browser extensions are among the fastest-growing and hardest-to-manage attack surfaces. They are hidden by default from traditional identity governance tools built for password-and-MFA use cases. Once granted, an OAuth token can persist for months or years - through password changes, MFA rollouts, and employee departures - with no visibility to IT.
- Recent breaches trace to exactly this class of failure. The Klue, Salesloft Drift, Salesforce ShinyHunters, and Vercel-Context.ai incidents in 2025-2026 are OAuth-grant or browser-extension compromises. Not one of them started with password brute force.
- Human-in-the-loop is the right posture. Fully autonomous revocation risks breaking legitimate business integrations. Fully manual review does not scale past 20 employees. Agentic governance with human approval on high-risk items is the durable operating model for NC SMB scale.
The Nudge announcement is one of several 2026 product launches converging on SaaS identity governance as the new attack-surface frontier. It matters to NC SMBs not because they must buy Nudge specifically, but because the underlying threat model - OAuth grants as an unmanaged risk plane - is what a 2026 breach looks like.
What Is the ShinyHunters Salesforce Campaign and Why Should NC SMBs Care?
Microsoft Threat Intelligence disclosed on July 13, 2026 a year-long campaign by ShinyHunters against Salesforce tenants. The campaign confirms three attack paths NC SMBs need to defend against on their own SaaS estate.
The three ShinyHunters attack paths:
- Consent phishing via fake Salesforce Data Loader. Attackers social-engineer employees into approving OAuth consent for a malicious app impersonating a legitimate Salesforce tool. Once granted, the app has API access to every Salesforce object.
- SaaS supply chain compromise. Attackers compromise a legitimate third-party SaaS vendor (Salesloft Drift is the canonical case), harvest OAuth tokens issued to that vendor by downstream customers, and pivot into hundreds of Salesforce tenants at once.
- Experience Cloud guest access. Attackers exploit misconfigured Salesforce Experience Cloud (formerly Communities) with permissive guest access, extracting object data via unauthenticated queries.
Three concrete facts about the campaign:
- 200+ tenants confirmed affected including Google, Chanel, Pandora. Attribution: ShinyHunters + Scattered Spider + LAPSUS$ subgroups now operating as a loose federation ("Scattered LAPSUS$ Hunters").
- Vishing pretext is the human vector. Attackers call the help desk impersonating IT, guide the target through an "urgent security update" that is actually an OAuth consent flow, and receive tokens.
- The pattern generalizes beyond Salesforce. Every SaaS that supports OAuth consent - Microsoft 365, Google Workspace, HubSpot, Zoom, Slack, Notion, Airtable, Monday.com, Asana - is exposed to the same class of attack. Salesforce is where the campaign has been named and measured, not where it stops.
For a typical NC SMB running M365 + HubSpot + one industry-specific SaaS, the exposure profile is: several dozen unreviewed OAuth grants issued over years, many by former employees, many to defunct or superseded tools, some to actively-abused apps that impersonate legitimate ones.
What About Browser Extensions?
The Vercel-Context.ai incident (disclosed 2026) is the canonical browser-extension case. A Lumma Stealer infection on a single Context.ai employee's machine in February 2026 exfiltrated an OAuth token scoped to Google Workspace. That token let attackers pivot into Vercel's internal environments, enumerate customer credentials, and extend blast radius across an entire cloud platform's customer base. All from one browser extension on one machine.
Three concrete facts about browser-extension risk:
- Browser extensions request broad permissions by design. Read every page, capture form input, access cookies and session tokens, run in privileged execution contexts. A malicious or compromised extension has more attack surface than most native apps.
- Extensions update silently. A benign extension can be sold, compromised, or coerced into malicious behavior via silent update. The user sees no change.
- The SaaS blast radius is real. An extension that captures the M365 session cookie has the same effective access as the user's account, and cookie-theft bypasses MFA at the browser level.
For a typical 50-100 person NC SMB, the browser-extension inventory is: hundreds of unique extensions across the user base, most unreviewed, some installed by former employees, and no visibility to IT.
Key takeaway: OAuth grants and browser extensions are the 2026 shadow-IT problem. They are not password problems. They will not be solved by cycling MFA or rolling out phishing-resistant WebAuthn. They require an identity-governance layer specifically designed for consent-based access.
How Should NC SMBs Respond in the Next 60 Days?
The response is a coordinated four-workstream program. Every NC SMB running a SaaS-heavy stack (which is every NC SMB in 2026) should complete all four workstreams inside 60 days.
Track 1 - OAuth grant inventory (Weeks 1-2).
- Pull the complete OAuth consent grant list from every SaaS tenant. In M365: Entra ID → Enterprise applications. In Google Workspace: Admin console → Security → API controls → App access control. In Salesforce: Setup → Connected Apps OAuth Usage. In HubSpot, Slack, and every other tenant: the same equivalent surface.
- Classify each grant. Actively used and known-vendor: retain. Actively used and unknown-vendor: investigate. Not-used-in-30-days or unknown-vendor: revoke.
- Rotate the credentials of any user who granted a high-risk revoked grant.
Track 2 - Admin consent workflow (Weeks 2-4).
- Turn off "users can consent to apps accessing company data on their behalf" in Entra ID for non-verified publishers. In Google Workspace enforce equivalent restrictions.
- Enable admin consent workflow so any request for an OAuth grant that requires above-baseline scopes routes to IT for approval.
- Document the approval SLA and staff for it. 24-hour turnaround is the operational floor.
Track 3 - Browser extension inventory and policy (Weeks 3-6).
- Deploy managed-browser policy (Microsoft Edge for Business, Google Chrome Enterprise) with a defined extension allow-list. Force-install the essential business extensions. Force-block everything else by default.
- Inventory currently-installed extensions across the fleet. Communicate the allow-list, hold a comment window, then enforce.
- Where a specific extension is business-critical but not on the vendor allow-list, run an itemized security review before adding it.
Track 4 - Vishing and consent-phishing training (Weeks 4-8).
- User training that specifically covers the OAuth consent flow. Show real screenshots. Walk through the Salesforce Data Loader impersonation pattern. Train users to reject any inbound help-desk call requesting an OAuth consent action.
- Update your help-desk workflows so an OAuth consent action is never a valid step in an inbound support call. The help desk requests a case ticket and calls back on an outbound-verified number.
- Rehearse the workflow with a red-team vishing exercise inside 60 days.
How Does This Compare to Traditional Identity Attacks?
The OAuth and browser-extension attack class differs from the traditional password-plus-MFA class in ways that matter for defense.
Comparison: Attack classes across SaaS identity, 2026.
| Attack Class | Vector | MFA Bypass | Traditional Defense | Right Defense |
|---|---|---|---|---|
| Password brute force | Credential guessing | No | Rate limits + password rotation | Passwordless / WebAuthn |
| Password phishing | Fake login page | No if MFA present | MFA + user training | Phishing-resistant MFA (WebAuthn) |
| AiTM phishing | Real-time proxy | Yes | User training only | Conditional access, session risk |
| SIM-swap MFA bypass | Telecom compromise | Yes for SMS | Number-porting locks | Passkeys, hardware keys |
| OAuth consent phishing | User-approved grant | Yes by design | User training only | Admin consent workflow + inventory |
| SaaS supply chain (Drift) | Vendor compromise | Yes by design | Vendor questionnaires | OAuth grant inventory + revocation cadence |
| Browser extension compromise | Extension pivots | Yes at cookie level | Endpoint MFA | Managed-browser policy + extension allow-list |
The pattern is stable. Every attack class that ends "yes" in the MFA-bypass column needs a defense outside the MFA layer. OAuth consent phishing is the class that most disproportionately hits NC SMBs today because it is the newest and least-understood.
Explore PDC's cybersecurity services - Managed IT services - Cloud solutions
How Does Preferred Data Handle SaaS Identity Governance for NC SMBs?
Preferred Data Corporation runs SaaS identity governance across NC SMB M365, Google Workspace, Salesforce, HubSpot, and industry-specific SaaS estates. Our program is a four-layer deliverable.
PDC's four-layer SaaS identity governance program:
- Discovery and inventory. Complete OAuth grant list across every SaaS tenant. Browser extension inventory across the managed fleet. Shadow-SaaS discovery via network telemetry, expense-report review, and single sign-on federation.
- Policy and workflow. Admin consent workflow enabled on M365 and equivalent tenants. Managed-browser policy with extension allow-list. Documented approval SLA and staffing.
- Continuous review and revocation. Quarterly grant review cycle. Immediate revocation of grants tied to departed employees. Vendor supply-chain monitoring so a Salesloft Drift-class breach triggers an in-tenant response inside 24 hours.
- Training and rehearsal. User training on OAuth consent phishing. Help-desk workflow hardening. Annual red-team vishing exercise.
Cost for a typical 40-100 person NC SMB on M365 + one SaaS: $6,000-$12,000 for initial engagement plus $500-$1,500/month managed. The delta versus the Vercel-Context.ai class of incident is measured in six or seven figures.
Frequently Asked Questions
What is an OAuth grant and why is it dangerous?
An OAuth grant is a user's explicit authorization for a third-party application to access their SaaS account (M365, Google Workspace, Salesforce, etc.) via API. Grants persist beyond password changes, MFA rollouts, and often beyond employee departures. A malicious or compromised app with an active OAuth grant has API-level access - read messages, download files, enumerate contacts, exfiltrate data - that bypasses MFA at the login layer because it is issued at the API layer.
What was the ShinyHunters Salesforce campaign about?
A year-long OAuth-abuse campaign attributed to ShinyHunters (operating in a federation with Scattered Spider and LAPSUS$ subgroups) that compromised 200+ Salesforce tenants including Google, Chanel, and Pandora. Three attack paths: consent phishing via fake Salesforce Data Loader, SaaS supply-chain compromise via Salesloft Drift OAuth tokens, and Experience Cloud guest-access misconfiguration. Microsoft Threat Intelligence disclosed the analysis on July 13, 2026.
How is this different from password phishing?
Password phishing steals a credential. MFA (properly deployed) defends it. OAuth consent phishing steals an authorization - a persistent API-scoped token. MFA does not defend it because MFA is enforced at login, not at API-token issuance. The defense is admin consent workflow plus grant inventory plus vendor supply-chain monitoring, not another MFA rollout.
Does my small business really need OAuth grant governance?
If you use Microsoft 365, Google Workspace, Salesforce, HubSpot, or any SaaS with third-party integrations, yes. Preferred Data engagements with NC SMBs routinely find dozens to hundreds of unreviewed OAuth grants issued over years - many to defunct tools, some to actively malicious apps that impersonate legitimate ones, many by employees who departed years ago.
What is Nudge Security and do we need to buy it?
Nudge Security is a SaaS identity governance platform that discovers, inventories, and helps remediate OAuth grants, browser extensions, and shadow SaaS. Their July 15, 2026 launch adds agentic capabilities for continuous analysis with human-in-the-loop remediation. Alternatives include Grip Security, Wing Security, AppOmni, and Obsidian Security. The right tool for your NC SMB depends on scale and SaaS mix; Preferred Data evaluates the fit as part of scoping.
How do we defend against consent phishing vishing calls?
Update your help-desk workflow so any inbound call that requests an OAuth consent action is rejected. The help desk requires a ticket, verifies the caller's identity out-of-band on a corporate-directory phone number, and calls back before proceeding. Train users on the specific pattern - an "IT" call that walks the user to an OAuth consent screen - with real screenshots and a rehearsed script.
How fast can PDC assess our SaaS environment?
A two-week discovery-and-inventory engagement produces the OAuth grant list, browser extension inventory, and shadow-SaaS map with prioritized remediation recommendations. Emergency revocation of high-risk grants happens same-week. Full governance program rollout is typically 60 days.
Related Resources
- Cybersecurity Services for NC Small Businesses
- Managed IT Services
- Cloud Solutions
- Contact PDC - request a SaaS identity governance assessment