AI
The Browser Is the New Battlefield
80% of threats enter through the browser. Identity lives there. Files live in SaaS. Traditional desktop applications have moved to cloud. The browser is the new center of the battle. Nishant argued this will age well as AI agents gain more control. Agents like Comet and other AI browsers were vulnerable at launch. They now ask for user confirmation on high-impact actions, but the trend is clear: more power in the browser means more attack surface.
OAuth Consent Hijacking: The Core Technique
Two demos showed the same pattern. A victim visits a site that offers free service and clicks “Login with Google.” The OAuth consent screen asks for scopes: read, compose, send, permanently delete all Gmail in the first demo; see, edit, create, delete all Google Drive files in the second. Most users click Allow. The attacker’s app then has persistent access until manually revoked. In Gmail, the attacker resets the victim’s Dropbox password, deletes the notification email, and exfiltrates files. In Google Drive, files are deleted and a ransom note uploaded. All automated, all in the browser.
Malicious Extensions as Attack Vector
Nishant revealed that only 3% of extension code does what the store listing claims. The other 97% does unrelated work: steal credentials, inject frames, redirect affiliate links. Extensions can change hands. A benign extension with 50,000 users can be purchased for $3,000 and updated to malicious code. Browsers auto-install new versions without the user noticing. Two weeks before the talk, Nishant’s team uncovered 60 such extensions targeting OTT platforms. Once installed, they monitor user activity and can feed it to AI for tailored attack planning.
Why EDRs Can’t Stop Browser-Native Ransomware
Traditional ransomware touches the endpoint. EDRs detect file encryption, suspicious processes, or mass file operations. Browser-native ransomware never reaches the disk. The attacker steals identity and tokens in the browser, then attacks cloud storage directly. No binary lands on the machine. Nishant compared this to the evolution of phishing: from simple credential theft to OAuth token theft and consent grant attacks. EDRs have no visibility into browser-level events. The only defense is either user awareness or a security solution that operates inside the browser.
Q&A
Is this happening at scale today? Not at enterprise scale yet, but it must be happening in pockets because the technique is so easy. ▶ 26:26
How do attackers get users to the malicious OAuth consent page? Supply chain attacks on extensions are one method. A popular extension can be compromised via a third-party component, injecting redirects. The OAuth consent hijacking itself abuses legitimate functionality. ▶ 27:30
What about whitelisting apps or extensions? Whitelisting requires managing many scopes and groups. Extensions change hands over time. A whitelisted extension today can turn malicious tomorrow. Just-in-time monitoring and interception capability is needed. ▶ 32:56
What mitigation is recommended for the OAuth consent part? User education helps but is insufficient. In real environments with 15 tabs open, spotting a malicious consent screen is unrealistic. Browser security solutions that sit as extensions or proxies can inspect and block before the user clicks. ▶ 29:40
Notable Quotes
80% of your threats are actually entering from the browser side Nishant Sharma · ▶ 1:54
the average ransom demand has gone from $5,000 to now $1 million Nishant Sharma · ▶ 3:20
3% of the code is doing what they are claiming to do. And then there is 97% of code that is doing completely different things Nishant Sharma · ▶ 9:35
it is not touching your machine. It is browser native. Nishant Sharma · ▶ 25:03
the only defense against these things is to make sure that you are not clicking on things and you’re reading things properly Nishant Sharma · ▶ 25:53
Key Takeaways
- OAuth consent attacks give attackers persistent cloud access without touching endpoints.
- 97% of extension code does unrelated activity; extensions can be weaponized after purchase.
- Browser-native ransomware bypasses EDR because it operates entirely in the browser.
About the Speaker
Nishant Sharma is a seasoned cybersecurity professional with deep expertise in threat research, browser security and hands-on technical training. He currently serves as Director, Threat Research at Zscaler and was previously the Head of Cybersecurity Research at SquareX (acquired by Zscaler).