threats

OAuth Consent Phishing

Updated October 16, 2026

OAuth consent phishing tricks a person into granting an application access to information or actions in a legitimate service. The person may sign in on the real provider’s website and never disclose a password to the attacker. The harmful step is approving inappropriate permissions for an application whose identity or purpose has not been established.

2 min. read

What do I need to know about OAuth Consent Phishing?

A legitimate consent screen does not establish that the requesting application is trustworthy.
Evaluate the application’s purpose, publisher, requested permissions, and organizational approval together.
Password changes do not necessarily remove application grants. Review and revoke inappropriate access through supported controls.
User consent and administrator consent can have different scopes and organizational impact.

An illustrative example

A message offers a productivity add-on for reading invoices. The user signs in normally but approves broad mail access for an unfamiliar application. The response team records the application identifier, permissions, grant time, and subsequent activity. Searching only for a stolen password would miss the core event.

Practical checks

Preserve the consent event and application identifiers, and determine who granted which permissions.
Disable or revoke inappropriate access under the organization’s response process and investigate the data or actions exposed.
Review consent policy, approval workflows, and other users who may have granted the same application access.

Five FAQs about OAuth Consent Phishing

Can consent phishing happen without a fake login page?

Yes. The real identity provider can host the login and permission screen. The attacker’s objective is the grant to the wrong application.

Does MFA stop this attack?

MFA protects authentication, but the user may authenticate legitimately before granting unsafe permissions. Consent review and application governance address that separate risk.

Will changing my password revoke the app?

Do not rely on that. Review the grant and application access directly using the provider’s supported controls, then investigate any related persistence or account activity.

Is a verified publisher enough to approve an application?

No single badge settles the business decision. Confirm the application is needed, approved, and requesting permissions proportionate to its purpose.

What should a user do after approving a suspicious app?

Report the application and approximate approval time promptly. Administrators can investigate and remove inappropriate access; avoid repeatedly opening the lure to gather more evidence yourself.