# What is OAuth consent phishing?

It is an attack in which the victim is tricked into granting a malicious app access to their account, rather than giving away a password. The user receives a link to what looks like a useful app or a document request, signs in on the real Microsoft or Google page, and clicks to approve permissions such as reading mail, files or contacts. From then on the attacker's app holds a token that works without the password and often survives a password reset and multi-factor authentication, because the user consented. It is effective precisely because every page the victim sees is genuine. Defences: restrict user consent so that only verified publishers or admin-approved apps can be granted access, require admin review for high-risk permissions, alert on new app consents, and review the list of connected apps regularly, removing anything nobody recognises. If you find a malicious grant, revoke the app and its tokens, then check what it accessed in the audit logs. A network sensor does not see consents, which happen inside the identity provider; that is where the controls belong.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/what-is-oauth-consent-phishing

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [Which cloud and SaaS logs should we switch on and keep?](https://netsenx.com/en/faq/what-logs-should-we-keep-for-cloud-and-saas)
- [What happens if cloud access keys leak, for example on GitHub?](https://netsenx.com/en/faq/what-happens-if-cloud-access-keys-leak)
- [What is a misconfigured storage bucket and how do we avoid one?](https://netsenx.com/en/faq/what-is-a-misconfigured-storage-bucket)
- [What is the cloud metadata service, and why do attackers want it?](https://netsenx.com/en/faq/what-is-the-cloud-metadata-service-and-why-do-attackers-want-it)
- [How do we spot cryptomining in a compromised cloud account?](https://netsenx.com/en/faq/how-to-spot-cryptomining-in-a-compromised-cloud-account)