Browser-based attacks exploiting OAuth flaws, MFA gaps, and malicious extensions drive large-scale data breaches.