Push Security Research

Browser & Identity Attacks Matrix

A collection of attack techniques organized by tactic phase. Inspired by MITRE ATT&CK and adapted for cloud-first environments where attacks require no network access or endpoint compromise.

10 phases51 techniques Source: github.com/pushsecurity/browser-identity-attacks-matrix

Reconnaissance

5 techniques

SAT1013DNS reconnaissance SAT1031SAML enumeration SAT1034Slug tenant enumeration SAT1035Subdomain tenant discovery SAT1038Username enumeration

Initial Access

24 techniques

SAT1002Account ambushing SAT1007App spraying SAT1010Consent phishing SAT1011Credential stuffing SAT1012Device code phishing SAT1015Email phishing SAT1017Ghost logins SAT1018IM phishing SAT1019IM user spoofing SAT1020In-app phishing SAT1024MFA fatigue SAT1025nOAuth SAT1030Poisoned tenants SAT1032SAMLjacking SAT1040Hijack OAuth flows SAT1042AiTM Phishing SAT1043Device Enrollment SAT1045MFA downgrade SAT1046Guest Access Abuse SAT1047Cross-IdP Impersonation SAT1048Verification phishing SAT1049UI redressing SAT1050App-specific password phishing SAT1051ConsentFix

Execution

4 techniques

SAT1008Automation workflow sharing SAT1009Client-side app spoofing SAT1027OAuth tokens SAT1033Shadow workflows

Persistence

12 techniques

SAT1004API keys SAT1009Client-side app spoofing SAT1016Evil twin integrations SAT1017Ghost logins SAT1022Link sharing SAT1023Malicious mail rules SAT1027OAuth tokens SAT1036System integrations SAT1041Inbound federation SAT1043Device Enrollment SAT1047Cross-IdP Impersonation SAT1050App-specific password phishing

Privilege Escalation

3 techniques

SAT1001Abuse existing OAuth integrations SAT1021Link backdooring SAT1023Malicious mail rules

Defense Evasion

11 techniques

SAT1004API keys SAT1009Client-side app spoofing SAT1012Device code phishing SAT1016Evil twin integrations SAT1017Ghost logins SAT1022Link sharing SAT1023Malicious mail rules SAT1036System integrations SAT1039Webhooks SAT1044Session cookie theft SAT1051ConsentFix

Credential Access

2 techniques

SAT1005API secret theft SAT1028Password scraping

Discovery

3 techniques

SAT1006App directory lookup SAT1014Email discovery SAT1026OAuth token enumeration

Lateral Movement

11 techniques

SAT1001Abuse existing OAuth integrations SAT1003Account recovery SAT1005API secret theft SAT1008Automation workflow sharing SAT1019IM user spoofing SAT1020In-app phishing SAT1021Link backdooring SAT1029Passwordless logins SAT1032SAMLjacking SAT1041Inbound federation SAT1044Session cookie theft

Exfiltration

3 techniques

SAT1033Shadow workflows SAT1037Takeout services SAT1039Webhooks

Explore use cases

Zero-day phishing protection

Browser extension security

Account takeover detection

Attack path hardening

ClickFix protection

Incident response

Secure shadow SaaS

Secure AI

Browser & Identity Attacks Matrix