Skip to content
Threat Feed

Tag

Google-Workspace

1 brief RSS
high advisory

Google Workspace Device Registration After OAuth from Suspicious ASN

Detects a sequence of events in Google Workspace where OAuth authorization from a suspicious ASN is immediately followed by device registration, potentially indicating attacker-controlled device enrollment after user authorization of a sensitive client, possibly related to Tycoon2FA.

Google Workspace cloud google-workspace persistence initial-access tycoon2fa
2r 2t