OAuth consent phishing : fonctionnement, signaux et que faire
Business fraud · alto
The victim gets an email with a link that opens a real consent screen hosted by the legitimate provider (for example, the Microsoft identity platform). An app named like a known service requests permissions such as reading email, contacts or files. By clicking "accept", the victim hands that access to the attacker.
Microsoft explains that, unlike credential compromise, the attacker targets users who can grant access directly to their data. Because the screen is hosted by the legitimate provider, many users accept the terms without suspicion. Signs include poor spelling or grammar, names and domains that imitate brands, and permission requests too broad for the stated purpose.
Sinais / Signs
- An email asking you to authorize an app you don't know
- A permissions screen requesting access to email, files or contacts
- Permissions that don't match the app's stated purpose
- A name or domain imitating a known brand
- Spelling or grammar errors in the email or consent screen
Prevenção / Prevention
- Read carefully which permissions the app requests
- Don't rely on the app name or domain alone
- Organizations: restrict consent to verified publishers and low-risk permissions
- Organizations: routinely audit apps and consented permissions
- Use the "Report it here" link on the consent prompt when suspicious
O que fazer / What to do
- Revoke the app's access in your account security settings
- Notify your IT or security team immediately
- Investigate the app's activity and any mailbox rules it created
- Warn contacts if the app sent messages in your name
FAQ
I didn't type a password. Could I still be compromised?
Yes. In consent phishing you grant the app permissions without handing over your password.
Is a verified publisher a guarantee of safety?
Not entirely. Microsoft recommends reviewing the consent prompt even when the publisher is verified.