Identity & AccessIntermediateAttack Technique1 validated evidence record

OAuth Consent Phishing

Also known as: Illicit Consent Grant

30 sec

A social-engineering attack that tricks users into granting a malicious application legitimate OAuth permissions.

Know

What is OAuth Consent Phishing?

A social-engineering attack that tricks users into granting a malicious application legitimate OAuth permissions. In practice, oauth consent phishing should be understood in the context of the identities, systems, applications, data, trust relationships, and business processes it affects. The useful question is not only what the term means, but how it changes attacker capability or defensive control.

Why it matters

A social-engineering attack that tricks users into granting a malicious application legitimate OAuth permissions. Attackers can use this behavior to turn a single weakness, identity, or interaction into broader compromise, so defenders need to recognize both the mechanism and the business consequence.

Evidence, not hype

Validated in the real world

Every record is labeled by evidence type and source strength so an incident, a standard, and emerging research are never presented as if they are the same thing.

Technical ValidationOperational validation

OAuth enables delegated authorization and can be abused through malicious consent

2025IETF / MicrosoftCloud identity

OAuth provides scoped delegated access without sharing a user's password. Microsoft documents consent-phishing attacks in which a malicious application requests legitimate permissions and a user is socially engineered into granting access to mail, files, contacts, or other cloud data.

Why this is evidence

It shows why application permissions and OAuth grants must be treated as first-class identity credentials and monitored independently of password resets or MFA enrollment.

See the source — Microsoft: Protect against consent phishing

Understand the mechanics

How it works

  1. 1

    An adversary identifies a condition where oauth consent phishing can provide access, control, information, or evasion.

  2. 2

    The attacker executes the technique directly or combines it with credentials, social engineering, exploitation, or trusted tools.

  3. 3

    Successful activity creates a new capability such as access, execution, persistence, privilege, movement, collection, or impact.

  4. 4

    Defenders investigate the surrounding identity, host, application, network, and cloud telemetry to determine scope and interrupt the attack chain.

Practice

What to watch for

  • Activity consistent with oauth consent phishing in identity, endpoint, email, application, cloud, or network telemetry
  • Unexpected authentication, privilege, execution, or data-access behavior
  • New or unusual infrastructure, domains, processes, tokens, or administrative actions
  • A sequence of events that matches a known adversary technique rather than normal business activity

Perform

What to do

  1. 1

    Stop or contain the risky activity without destroying useful evidence.

  2. 2

    Determine which identities, systems, applications, data, and sessions are affected.

  3. 3

    Revoke exposed access, isolate compromised assets, and block malicious infrastructure as appropriate.

  4. 4

    Hunt for related oauth consent phishing activity and adjacent attacker behaviors before declaring the incident contained.

How to reduce the risk

  • Require phishing-resistant MFA for high-value access.
  • Apply least privilege and separate privileged identities.
  • Monitor sign-ins, tokens, application grants, and directory changes.
  • Revoke sessions and rotate exposed credentials after compromise.

Business impact

  • Account takeover
  • Privilege abuse
  • Lateral movement
  • Persistent unauthorized access

What different roles should do

Employee / Operator

  • Pause when an interaction or system behavior is unexpected.
  • Use approved verification and reporting paths rather than improvising.

Security

  • Correlate identity, endpoint, network, application, and cloud evidence.
  • Contain the attack path and hunt for follow-on activity.

Framework & standards context

  • NIST Cybersecurity Framework (CSF) 2.0

Keep learning

Source transparency

Authoritative sources

Last reviewed: 2026-09-02