OAuth Tokens Are Quietly Becoming the Skeleton Key to Google Workspace

Key points

• Attackers are breaking into Google Workspace accounts without needing a password, by stealing OAuth tokens, the digital passes that third-party apps use to access Gmail and Drive on a user's behalf.
• Once a token is stolen, the attacker can read email, download files, and pivot to connected apps while looking like a legitimate signed-in session.
• Security firm Material Security argues defenders keep focusing on the login step and missing the rest of the chain.
• AI assistants plugged into Workspace expand the blast radius, because a single stolen token can now feed a bot that summarises an entire mailbox in seconds.
• Standard multi-factor authentication does not stop a token that has already been issued.

Most people picture a Google Workspace break-in the same way: a fake login page, a stolen password, a scramble to reset it. That story is only half right. A quieter path is doing real damage, and it does not touch the login screen at all.

Security vendor Material Security, in analysis picked up by BleepingComputer, is pushing defenders to look at the full attack chain against Workspace, not just the front door. The failure mode here is simple. Once a user clicks "Allow" on a third-party app, Google issues an OAuth token. That token, think of it as a hotel keycard the app keeps in its pocket, lets the app read mail or files without asking for the password again.

Steal the keycard and you skip the lobby.

How do attackers actually get in without a password?

They trick users into approving a malicious app, or they grab tokens from a machine that is already infected. Neither step involves guessing a password or defeating multi-factor authentication, the extra code from a phone that is meant to stop account takeovers.

In practice, the con looks like a normal app consent screen. A user sees a request from something called "Docs Reviewer" or "Calendar Sync Pro" and clicks through. Behind that button, the app is asking for permission to read every email in the mailbox. Google honours the request because the user honoured it. From that moment on, the attacker's traffic looks like a legitimate app doing legitimate work.

Infostealer malware, small programs that scrape saved credentials and session data from a browser, is the other big supplier. It lifts tokens straight off the endpoint and ships them to a criminal marketplace.

Why does AI make this worse?

Because AI assistants now sit on top of Workspace with the same tokens. A stolen pass that used to grant a slow, manual read of a mailbox can now feed a language model that summarises years of email in minutes. Sensitive data leaves faster and in a more useful shape for the buyer.

That is the part vendors tend to gloss over in the AI pitch. The permissions model did not get rethought when the assistants arrived. It got extended.

What does this mean for ordinary users?

Check what apps you have connected to your Google account. Go to your Google Account, then Security, then "Your connections to third-party apps and services". Anything you do not recognise, remove. Do the same for your work account if your employer allows it.

If your organisation runs Workspace, the operational picture is uglier. Admins should be pulling the OAuth app inventory regularly, restricting which scopes third-party apps can request, and treating a new high-privilege consent grant as an event worth investigating, not a log line to archive.

One thing the post-mortem will say: the login was fine. The consent screen was the breach.

Operational takeaway: audit your OAuth grants this quarter, not next.