Stolen OAuth tokens, which are at the root of these breaches, "are the new attack surface, the new lateral movement," a ...