OAuth Consent Phishing

OAuth consent phishing is a phishing technique in which an attacker tries to convince a user to grant a malicious application permission to access their account or data.

Unlike traditional phishing, the attacker may never ask for the victim’s password.

Instead, the victim may be directed to a legitimate Microsoft, Google, or other authorization page. The page displays permissions requested by an application and asks the user to approve them.

The malicious application may have a trustworthy-sounding name or branding designed to make it appear legitimate.

If the user selects Accept or Allow, the application may receive an OAuth token that provides access to whatever information or capabilities were approved.

Depending on the permissions granted, this could include email, files, contacts, profile information, or other cloud resources.

What This Means for SMBs

Employees have learned to be suspicious of webpages asking for passwords. OAuth consent phishing requires them to develop another habit:

Be careful about what applications you authorize.

Users should review:

• The application’s name
• Who published it
• Why it needs access
• Which permissions it is requesting
• Whether the application was approved by the organization

Businesses should also review what third-party applications are connected to company accounts and restrict user consent where appropriate.

What This Means for MSPs

MSPs can help clients configure application-consent policies and monitor for suspicious OAuth applications.

When responding to a compromised cloud account, MSPs should look beyond password resets and review:

• OAuth consent grants
• Enterprise applications
• Active tokens
• Suspicious inbox or forwarding rules
• Sign-in activity
• Other persistence mechanisms

A malicious application may retain access even after a user changes a password, depending on the environment and authorization granted.

Practical Takeaway

Modern phishing does not always ask for your password.

Sometimes the attacker simply asks you to click Allow.

Users should treat application-permission screens with the same caution they use for login pages.

---

Additional Reading:

CyberHoot does have some other resources available for your use. Below are links to all of our resources, feel free to check them out whenever you like:

• Blog
• Cybrary (Cyber Library)
• Infographics
• Newsletters
• Press Releases
• Instructional Articles (HowTo) – very helpful for our Super Admins!

---

Secure your business with CyberHoot today!