(Source: WSAW) The fake app used OAuth and tricked users into trusting it with their security token. The attackers could then see users’ contacts and send the phishing attempt to …