OAuth consent phishing
OAuth consent phishing gets a user to grant a malicious third-party app access to their mailbox or files through a genuine Microsoft or Google consent screen, without stealing the password.
How it works
The attacker registers an app with a convincing name and requests permissions such as reading mail. The victim receives a link to the real identity provider, signs in normally and clicks Accept.
The app then receives tokens that keep working after a password change, until the consent is revoked.
How to protect yourself
- Read the app name, publisher and requested permissions on every consent screen; decline unexpected requests.
- Administrators can restrict user consent and review granted applications regularly.