In the scenario of OAuth email auto-linking, the attacker does not need to crack a password or phish; they only need to register an email address identical to the victim's at a provider that allows unverified emails and initiate one OAuth login to complete account takeover, and because the login goes through a legitimate OAuth flow, anomalies are often invisible in the logs.