{"id":550993,"date":"2026-05-26T23:48:07","date_gmt":"2026-05-26T23:48:07","guid":{"rendered":"https:\/\/www.harrisburgnewsnow.com\/news\/story\/550993\/how-did-a-stolen-oauth-token-bypass-mfa-in-the-2m-supply-chain-attack.html"},"modified":"2026-05-26T23:48:07","modified_gmt":"2026-05-26T23:48:07","slug":"how-did-a-stolen-oauth-token-bypass-mfa-in-the-2m-supply-chain-attack","status":"publish","type":"post","link":"http:\/\/www.honolulunewsnow.com\/news\/story\/550993\/how-did-a-stolen-oauth-token-bypass-mfa-in-the-2m-supply-chain-attack.html","title":{"rendered":"How Did a Stolen OAuth Token Bypass MFA in the $2M Supply Chain Attack?"},"content":{"rendered":"
\"How<\/a><\/p>\n
\n
Security analyst monitoring a potential supply chain attack on an ultra-wide screen.<\/div>\n<\/div>\n<\/div>\n
<\/div>\n
Network Threat Detection analyzed the recent Vercel breach, where attackers used a stolen OAuth session token from an infected personal device to bypass multi-factor authentication and access internal systems. The breach exposed around 580 employee records and involved a $2 million ransom demand linked to customer environment variables, highlighting how attackers are increasingly targeting trusted OAuth relationships instead of breaking authentication systems. <\/div>\n

Network Threat Detection found that token replay attacks allow access without triggering MFA, making traditional defenses insufficient when session tokens are compromised.<\/p>\n

“Network Threat Detection analysis shows this is not a single breach, but a pattern,” said a spokesperson for Network Threat Detection. “Attackers are targeting identity trust chains between vendors, not just credentials.”<\/p>\n

Key Findings from the Analysis<\/strong><\/p>\n