OAuth Consent Phishing Campaigns Targeting Account Permissions

Since late 2025, malicious actors have been leveraging OAuth consent phishing to gain unauthorized access to user accounts. By impersonating government officials, media figures, or event coordinators via commercial messaging applications (CMA), attackers deceive victims into clicking links that lead to legitimate OAuth permission request screens. Unlike credential harvesting, this technique does not require the user's password; instead, it tricks the user into granting a malicious application broad access to their account data, such as email read/write permissions. Once granted, the attacker maintains persistent access to the account even if the victim changes their password. The victim must manually revoke the token through their account security settings to terminate the unauthorized access. This technique effectively bypasses multi-factor authentication (MFA) because the access is authorized via a legitimate service provider protocol.

Attack Chain

1. Attacker creates a malicious application within a legitimate OAuth-enabled platform.
2. Attacker performs reconnaissance to identify targets and establishes rapport via a commercial messaging application.
3. Attacker sends a phishing message impersonating a trusted entity to the target.
4. Victim clicks a link provided in the message, which redirects them to a legitimate service provider's OAuth consent screen.
5. The OAuth screen prompts the victim to grant specific permissions (e.g., read email, access files) to the attacker-controlled application.
6. Victim approves the consent request, unknowingly granting the attacker an access token.
7. Attacker utilizes the granted token to access the victim's account, exfiltrate data, or send further phishing messages from the compromised account.
8. Attacker maintains persistence by keeping the authorized application active in the account's security settings.

Impact

Victims targeted include prominent individuals, family members, and personal acquaintances. Successful exploitation results in persistent, unauthenticated access to sensitive data and the ability for the attacker to communicate on behalf of the victim. Because access is granted at the application level, standard security measures like password resets or MFA do not remove the adversary's access, leading to long-term compromise of account communications and associated cloud data.

Recommendation

Prioritize defensive efforts to audit and restrict OAuth applications and monitor for unauthorized token grants.

• Implement an enterprise OAuth application policy to restrict or require administrative approval for users to grant permissions to new or unverified third-party applications.
• Review current OAuth application permissions in SaaS/cloud environments to identify and revoke access for suspicious, unused, or unauthorized applications.
• Educate users on the distinction between entering credentials and granting application-level access permissions.
• Monitor logs for unusual OAuth grant events, specifically focusing on applications with high-privilege scopes (e.g., Mail.Read, Mail.Send, Files.ReadWrite) granted to non-standard or external publishers.