Don’t trust OAuth: Why the “Google Docs” worm was so convincing

https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/