Google Workspace Chrome OAuth Authorize

Ibrahim Saud@tektrix

•updated Jun 18, 2026•2•0•6

Detects Google Workspace OAuth authorizations requesting the Chrome native client ID, which has been observed to be used by threat actors like Tycoon 2FA to mint tokens for illicit access.