Consent Phishing (Illicit Consent Grant)

Consent phishing, which Microsoft calls an illicit consent grant, is an attack in which a user is tricked into granting OAuth permissions to an attacker-controlled application, giving the attacker tokens to read mail, files, or other data without ever learning the user's password. MITRE ATT&CK tracks it under T1528, Steal Application Access Token.

The consent screen is genuine, which is what makes this attack hard to train against: the URL belongs to Microsoft or Google, the sign-in is real, and MFA passes. What the user approves is an app with a plausible name requesting scopes such as offline access and mail read. The grant survives a password reset, because the attacker holds a refresh token tied to the app, not the user's credentials. The controls are administrative: restrict user consent to verified publishers and low-risk scopes, require admin approval for everything else, review existing grants, and revoke the app's service principal (not just the user's sessions) when you find one.

See also: OAuth consent phishing technique, scope, refresh token abuse, token theft, service principal, device code flow