Malicious OAuth App Consent

Layer 7: Application High risk

How it works

Microsoft 365 and Google Workspace let third-party apps request access to a user's data through a consent screen. In a consent phishing attack, a user receives a link that leads to a genuine Microsoft or Google page asking them to grant permissions to an app with a harmless-sounding name. Because the page itself is legitimate, it does not look like a typical fake login.

If the user clicks Accept, the app receives a token that lets it read email, send messages, or access files on their behalf. Changing the password does not remove that access, and multi-factor authentication does not stop it because the user approved it. The attacker can quietly harvest data or use the mailbox for further fraud until the app is found and removed.

Warning signs

• Unexpected prompts asking you to grant an app access to your account
• Unfamiliar apps listed in your account's connected apps
• Apps requesting broad permissions like reading all mail
• Mail sent from your account that you did not write
• Apps from unverified publishers

How to defend against it

• Restrict user consent to verified publishers or require admin approval
• Set up an admin consent workflow for app requests
• Review connected applications regularly
• Alert on new high-permission app grants
• Train users to treat consent prompts with caution

If it happens to you

1. Revoke the app's permissions and remove it from the tenant
2. Review audit logs for data the app accessed
3. Check for mailbox rules or other persistence
4. Block the app tenant-wide to prevent re-consent