OAuth Consent Phishing: The Attack Vector You're Not Monitoring

While organizations focus on email phishing, a more insidious attack vector is growing rapidly: OAuth consent phishing. Instead of stealing passwords, attackers trick users into granting permissions to malicious applications, providing persistent, MFA-resistant access to organizational data.

## How OAuth Consent Phishing Works

1. **The bait**: A user receives an email or message with a link to authorize an application 2. **The consent screen**: The link opens a legitimate Microsoft consent dialog requesting permissions 3. **The grant**: The user clicks "Accept," granting the malicious app access to their data 4. **Persistent access**: The app now has an OAuth token that works independently of the user's password or MFA status

## Why It's Dangerous

OAuth consent phishing is particularly dangerous because:

- **MFA doesn't help**: The access token bypasses multi-factor authentication - **Password changes don't help**: Tokens remain valid even after password resets - **It's legitimate infrastructure**: The consent dialog is a real Microsoft page - **Access is persistent**: Tokens can be valid for months or even indefinitely - **It's hard to detect**: The activity appears to come from an authorized application

## Common Attack Patterns

### Data Exfiltration Apps Malicious apps request Mail.Read, Files.Read.All, and similar permissions. Once granted, they silently export emails, documents, and contacts.

### Persistence Apps Apps requesting offline_access maintain a refresh token that provides indefinite access, even if the user changes their password.

### Lateral Movement Apps Apps with User.ReadWrite.All or Directory.ReadWrite.All permissions can modify user profiles, create new accounts, or escalate privileges.

## Detection with PhishFortress

PhishFortress monitors your Microsoft 365 environment for OAuth abuse indicators:

- **New app registrations**: We track all new OAuth applications and their requested permissions - **Unusual consent grants**: Behavioral analysis flags when users grant permissions to unfamiliar applications - **Token usage anomalies**: We monitor API access patterns for signs of automated data exfiltration - **Permission scope analysis**: We alert on applications requesting excessive or dangerous permission combinations

## Remediation Steps

1. Review and revoke unnecessary enterprise application consent 2. Configure consent workflows to require admin approval 3. Block user consent for applications from unverified publishers 4. Monitor Azure AD audit logs for consent grant events 5. Deploy PhishFortress for continuous OAuth monitoring

OAuth consent phishing represents a fundamental shift in how attackers gain access to cloud environments. Organizations must adapt their security posture accordingly.