What is consent phishing (OAuth phishing)?

How it works

Microsoft Learn explains that consent phishing tricks users into granting permissions to malicious cloud applications, which can then reach legitimate services and data. The consent screen lists the permissions, but because a legitimate provider hosts it, unsuspecting users accept. No password changes hands.

A real example

Microsoft describes what happens when it disables a malicious OAuth app after confirming a violation: new token requests are denied, but existing access tokens stay valid until they expire. Its guidance warns not to rely on application names and domains, which attackers spoof, and to check the permissions an app requests.

How to train for it

• Read the permissions on a consent screen before you accept.
• Be wary of apps asking for access you would not expect them to need.
• Report a suspicious consent prompt with the link on the prompt or to IT.

Admins can limit user consent to verified publishers and low-risk permissions. SecurityRing does not currently list consent phishing as a simulation type.