What is OAuth consent phishing?

It is an attack in which the victim is tricked into granting a malicious app access to their account, rather than giving away a password. The user receives a link to what looks like a useful app or a document request, signs in on the real Microsoft or Google page, and clicks to approve permissions such as reading mail, files or contacts. From then on the attacker's app holds a token that works without the password and often survives a password reset and multi-factor authentication, because the user consented. It is effective precisely because every page the victim sees is genuine. Defences: restrict user consent so that only verified publishers or admin-approved apps can be granted access, require admin review for high-risk permissions, alert on new app consents, and review the list of connected apps regularly, removing anything nobody recognises. If you find a malicious grant, revoke the app and its tokens, then check what it accessed in the audit logs. A network sensor does not see consents, which happen inside the identity provider; that is where the controls belong.

← All 25 questions on Cloud and SaaS securityAll topics