New OAuth grant to GitHub/Slack following cross-app SSO pivot

Arnold Chan@slaz

•updated Sep 19, 2026•1•0•2

Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.