# consent-phishing

Source: https://startwithidentity.com/glossary/consent-phishing/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

Consent phishing, which Microsoft calls an [illicit consent grant](https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-grants), is an attack in which a user is tricked into granting OAuth permissions to an attacker-controlled application, giving the attacker tokens to read mail, files, or other data without ever learning the user's password. MITRE ATT&CK tracks it under [T1528, Steal Application Access Token](https://attack.mitre.org/techniques/T1528/).

The consent screen is genuine, which is what makes this attack hard to train against: the URL belongs to Microsoft or Google, the sign-in is real, and MFA passes. What the user approves is an app with a plausible name requesting scopes such as offline access and mail read. The grant survives a password reset, because the attacker holds a refresh token tied to the app, not the user's credentials. The controls are administrative: restrict user consent to verified publishers and low-risk scopes, require admin approval for everything else, review existing grants, and revoke the app's service principal (not just the user's sessions) when you find one.

See also: [OAuth consent phishing technique](https://startwithidentity.com/techniques/oauth-consent-phishing/), [scope](https://startwithidentity.com/glossary/scope/), [refresh token abuse](https://startwithidentity.com/techniques/refresh-token-abuse/), [token theft](https://startwithidentity.com/glossary/token-theft/), [service principal](https://startwithidentity.com/glossary/service-principal/), [device code flow](https://startwithidentity.com/glossary/device-code-flow/)