Attacker breached dozens of orgs utilizing stolen OAuth tokens