# OAuth consent phishing

OAuth consent phishing gets a user to grant a malicious third-party app access to their mailbox or files through a genuine Microsoft or Google consent screen, without stealing the password.

## How it works

The attacker registers an app with a convincing name and requests permissions such as reading mail. The victim receives a link to the real identity provider, signs in normally and clicks Accept.

The app then receives tokens that keep working after a password change, until the consent is revoked.

## How to protect yourself

- Read the app name, publisher and requested permissions on every consent screen; decline unexpected requests.
- Administrators can restrict user consent and review granted applications regularly.

## Related tools

- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)
- [Scam Triage Wizard](https://phishdestroy.io/developer-tools/scam-triage-wizard)

## Related terms

- [Device code phishing](https://phishdestroy.io/glossary/device-code-phishing/)
- [Business email compromise (BEC)](https://phishdestroy.io/glossary/bec/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/oauth-consent-phishing/