OAuth Consent Phishing

What it is

OAuth consent phishing tricks a user into authorizing a malicious application through a legitimate identity provider. The login screen may be entirely genuine. The attack is the permission grant: the app can receive scoped access to mail, files, contacts, or other resources without learning the user's password.

How it works

A message invites the user to open a useful document or service. The authorization screen lists requested permissions, and consent gives the app tokens it can use afterward. Depending on the grant, refresh tokens may support continued access. App names and logos can imitate familiar products without proving publisher trust.

How people get tricked

Seeing the real identity-provider domain makes the whole process feel safe. Users may not distinguish signing in from allowing a third-party app to read data. Permissions that far exceed the advertised task can be overlooked as routine setup.

Example scenario

A supposed document viewer asks to read your entire mailbox and maintain access. You sign in safely to the real provider, but the resulting grant lets an attacker-controlled app collect messages.

Warning signs

• An unfamiliar app requests broad mail or file access.
• The publisher or permissions do not match the promised function.
• New application grants appear after an unexpected invitation.

If it happens to you

Revoke the application's grant and associated tokens through the provider's connected-app controls. Investigate what data it accessed and any related changes. Changing a password alone may leave the authorization intact; verify removal rather than assuming recovery is complete.