Consent Phishing

Consent phishing (also called OAuth phishing or illicit consent grant attack) tricks a victim into authorizing a malicious application to access their cloud account through a legitimate permissions screen. Instead of stealing a password, the attacker gets the victim to click "Accept" on a real Microsoft 365 or Google Workspace consent dialog — granting the attacker's app durable API access to mail, files, and contacts. No credentials are captured, and MFA never blocks it, because the victim genuinely authenticates on the real identity provider.

How it works

1. The attacker registers an OAuth application with an innocuous name — "Document Viewer", "Upgrade Mailbox", "Security Update" — and requests permission scopes like read/write access to email, files, or calendar.
2. The lure arrives as an email or chat message with a link to open a shared document or enable a feature. The link leads to the genuine login and consent page of the victim's identity provider — the URL is real, the padlock is real, and everything awareness training says to check looks right.
3. The victim clicks "Accept." The consent screen lists the requested permissions, but users conditioned to click through cookie banners and permission dialogs rarely read them.
4. The attacker's app receives access tokens and can now read and send mail, exfiltrate files, and set up inbox rules — persistently, from the attacker's own infrastructure. The access survives password resets, since the app's tokens are independent of the password; only revoking the consent grant cuts it off.

Consent phishing is a favored follow-on to conventional phishing precisely because it defeats the defenses organizations added against it: strong passwords, MFA, and URL inspection all pass. Like session hijacking, it targets tokens rather than credentials.

How to defend against it

• Restrict user consent in your identity platform: allow only verified publishers or admin-approved apps, and route other requests through an admin consent workflow.
• Audit existing grants regularly for unused or over-permissioned apps, and alert on new high-risk consents.
• Revoke, don't just reset. Incident response for a suspicious grant must remove the app's permissions — a password change alone does nothing.
• Train the specific reflex: an unexpected app asking to "read and send your mail" is an attack, even on a genuine Microsoft page. Consent-screen scenarios belong in modern security awareness training alongside classic credential lures.