OAuth Consent Phishing
A phishing technique that tricks a user into granting a malicious third-party application broad account permissions through the real login provider's own consent screen, without ever needing the user's password.
Definition
OAuth consent phishing, also called an illicit consent grant attack, tricks a user into granting a malicious third-party application access to their account, such as Microsoft 365 or Google Workspace, through the real identity provider's own legitimate OAuth consent screen. Because the victim authenticates directly with the genuine provider and only approves a permissions request, the attacker never needs to steal a password or defeat multi-factor authentication at all; the user grants the access willingly, simply without understanding what they are agreeing to.
The attack typically begins with a phishing email inviting the victim to use a seemingly useful app, such as a document viewer, survey tool, or productivity add-in, by clicking 'Sign in with Microsoft' or 'Sign in with Google.' This redirects the victim to the real login provider, where they enter their actual credentials directly on the legitimate site, so anything a security-aware user checks about the domain looks correct. The provider then displays its own consent screen, listing the permissions the app is requesting, such as reading email, accessing files, or sending mail as the user, and if the victim clicks 'Accept' without reading closely, the malicious app is granted an access token with those permissions.
This makes OAuth consent phishing especially dangerous because it sidesteps the two defenses organizations rely on most: since no password is entered on a fake page, there is nothing for a phishing filter looking for credential harvesting to catch, and because the user authenticates through the real MFA flow, multi-factor authentication provides no protection at all. The granted access token typically persists until it is explicitly revoked, meaning an attacker can continue reading email or exfiltrating files long after the initial phishing email is forgotten, and a password reset does nothing to remove the access. This technique has been used against Microsoft 365 tenants globally and is a growing concern for Indonesian organizations that have not restricted which third-party apps employees are allowed to authorize.
The most effective defense is administrative: restricting user consent so that only administrator-approved applications can request account permissions, rather than leaving consent decisions to individual employees. Regularly auditing the list of third-party applications with access to the organization's tenant and revoking anything unrecognized or unnecessary closes off access that may already have been granted. Employee awareness still matters, since recognizing an unfamiliar app requesting broad permissions, such as full mailbox access, and reading a consent screen carefully before accepting remain valuable habits even where administrative controls are in place.
At a glance
- Severity
- High
- Prevalence
- Growing
- Primary targets
- Microsoft 365 and Google Workspace tenants
- Also known as
- Illicit consent grant, OAuth phishing
How it works
- 1
Malicious app registration: an attacker registers a third-party application with a legitimate identity provider, giving it an innocuous name and icon.
- 2
Lure delivery: the victim receives a phishing email inviting them to use the app via a 'Sign in with Microsoft' or 'Sign in with Google' button.
- 3
Genuine authentication: the victim is redirected to the real provider and logs in directly, so no password is entered on a fake page and MFA completes normally.
- 4
Consent screen: the provider displays its own legitimate screen listing the permissions the app is requesting, such as reading mail or accessing files.
- 5
Grant: the victim clicks accept without fully reading the request, and the malicious app receives an access token with those permissions.
- 6
Persistent access: the attacker uses the token to read email, exfiltrate files, or send messages as the user, unaffected by a later password reset.
Warning signs
- An unfamiliar app name or publisher requesting to 'Sign in with Microsoft' or 'Sign in with Google'
- A consent screen asking for broad permissions, such as full mailbox access or file access, for an app you do not recognize
- Being redirected through an unexpected third-party page before or after the real login screen
- An app appearing in your account's connected-apps or consent list that you do not remember authorizing
- Unusual mailbox activity, such as unfamiliar sent items or rules, with no corresponding password-reset alert
How to defend
- Restrict user consent at the administrator level so only pre-approved applications can request account permissions
- Regularly audit the list of third-party applications with access to your organization's tenant and revoke anything unnecessary
- Train employees to read consent screens carefully and question unfamiliar apps requesting broad permissions
- Require administrator review before granting any application access to email, files, or directory data
- Set up alerts for new high-privilege OAuth grants so security teams can review them promptly
- Treat a password reset as insufficient remediation; explicitly revoke any suspicious app's access token as well
Real-world example
An employee at a government agency receives an email inviting them to review a shared document using a 'PDF Signer' add-in. Clicking through takes them to the real Microsoft login page, where they sign in as usual and complete their normal MFA prompt without concern. A consent screen then asks for permission to read and send mail on the employee's behalf; they click accept without reading closely. Weeks later, the attacker is still quietly reading the mailbox using the granted token, even though the employee has since changed their password twice.
How Claro helps
Claro's phishing simulation library includes OAuth-style consent scenarios alongside traditional credential-harvesting lures, so employees learn to scrutinize permission requests, not just login pages, before clicking accept. Awareness content built for Indonesian Microsoft 365 and Google Workspace tenants helps security teams pair employee training with the administrative consent restrictions that close this password-free attack path for good.
Frequently asked questions
Does OAuth consent phishing steal my password?
No. The victim logs in directly with the real identity provider and never enters credentials on a fake page. The attack instead tricks the user into granting a malicious app permission through a legitimate consent screen.
Why doesn't multi-factor authentication stop OAuth consent phishing?
Because the victim completes the real MFA challenge as part of a genuine login to the real provider. MFA protects the login step, but the actual attack happens at the consent step afterward, which MFA does not cover.
Does changing my password remove a malicious app's access?
No. The access token granted to the malicious app typically remains valid independent of your password. The app's access must be explicitly revoked in your account's connected-apps or consent settings.
How can organizations prevent OAuth consent phishing?
The most reliable control is restricting user consent so employees cannot approve new third-party app permissions themselves, requiring administrator review instead, combined with regular audits of already-authorized applications.
Related terms
Phishing
Phishing is a social engineering attack where criminals impersonate a trusted sender to trick people into revealing credentials, transferring money, or installing malware.
Account Takeover
When an attacker gains unauthorized control of a user's online account, typically through stolen credentials, and uses it for fraud or further attacks.
Credential Harvesting
Credential harvesting is the theft of usernames, passwords, and other login data, usually through fake login pages or deceptive messages, so attackers can access accounts and systems.
Reduce your human risk
Claro measures and lowers the risk these terms describe, in English and Bahasa Indonesia.
Request a demo