OAuth Consent Phishing

HighIdentity & AccessA07:2021 – Identification and Authentication Failures

Users are tricked into granting a malicious third-party OAuth application access to their mail, files, or profile, giving the attacker persistent API access that survives password resets.

Immediate Response

1Revoke the malicious app's grants and refresh tokens for all users.
2Disable the service principal or app registration in the tenant.
3Review audit logs for data the app read, sent, or downloaded.
4Notify affected users and reset credentials where the app had write access.

All playbooks

1Restrict user consent to verified publishers and low-risk scopes.
2Enable an admin consent workflow for any other app requests.
3Block device code flow where it is not needed.
4Alert on new grants with mail, file, or directory scopes.

Long-term Prevention

1Review all third-party app grants on a recurring schedule and remove unused ones.
2Use app governance or CASB tooling to score and monitor OAuth apps.
3Train users to recognize consent screens and unexpected permission requests.
4Include OAuth app abuse in incident response runbooks and tabletop exercises.

Attack vectors

Phishing links to a legitimate identity provider consent screen for a malicious app
Apps with convincing names and logos requesting broad scopes like Mail.Read or offline_access
Device code phishing that has users enter a code on a real login page
Compromised legitimate apps pushing malicious updates with new scopes

Indicators of compromise

New OAuth grants with high-privilege scopes from unverified publishers
Large volumes of Graph or Gmail API calls from a recently consented app
Many users consenting to the same unfamiliar app in a short time
Refresh token use from infrastructure unrelated to the app's stated vendor

Tooling

Microsoft Entra IDGoogle Workspace Admin ConsoleMicrosoft Defender for Cloud Apps