6 Jul 2021
Secure OAuth permissions and applications
OAuth apps are used on almost all cloud platforms and when users install them they grant the app owner permanent access to potentially anything they have access to in a way that can be hard to spot.
Discover malicious OAuth apps
Scan your cloud platforms for malicious OAuth apps.
No credit card needed
What's a malicious OAuth app?
Cloud platforms like Microsoft 365, Google Workspace, or Slack use OAuth to allow users to extend functionality with new apps and services. Malicious OAuth apps are usually installed via consent phishing where an attacker creates an app and entices a user to install it, giving the attacker access to the user's account. Since this attack uses the legitimate OAuth install process, it doesn't have many of the things users have been trained to look for in phishing attacks. Since users need to be logged in already, it also isn't stopped or affected by strong passwords or MFA. Learn more.
Get a clear picture of your OAuth apps
Connect your cloud platforms to clearly see which apps are installed by which users and what those apps can do.
Find malicious apps
Data is enriched to show the information you need to determine if the app should be allowed. See publisher information, install base, and what the app can actually do with the scopes specified to make an informed decision.
Get instant detection and response to stop future attacks
Automatically reach out to users who try to install apps that look suspicious or high risk. Combine ChatOps with the admin consent flow to manage the process efficiently and with minimal effort.
Supported platforms:
Google Workspace
Microsoft 365
Ready to check your cloud platforms for malicious OAuth apps?
Want to see it in action?
Looking to solve a different SaaS security problem?
Need another problem solved?
We're always on the lookout for new SaaS security problems that we can use our automation platform to help our users solve. If you have something in mind, let us know.
Contact us
Why Push?
We started Push with a single no-nonsense goal - to help busy security teams get important security controls handled in as little time as possible.
Push is different because where most security tools give you a todo list, we take work away. We don’t find problems that we don’t also solve for you.