OAuth apps have become prominent in several attack groups’ TTPs in recent years. OAuth apps are used for every part of the attack process.

Source: Help Net Security