Consent phishing: an underestimated risk and how to protect yourself

A particularly devious scam is turning up more and more often: consent phishing. This type of phishing aims to trick users into giving their permission, so that attackers gain access to sensitive data and systems. Why do attackers use this method, and how can you protect yourself?

The tactic behind consent phishing

Consent phishing differs from conventional phishing in that it does not ask for passwords directly. Instead, victims are tricked into granting an application access permissions to their data or services, often through well-disguised consent requests. This tactic is particularly insidious because it bypasses the safeguards many companies have introduced, such as regular password changes or two-factor authentication.

Consent phishing attack flow (source: Microsoft)

Attackers' motives and methods

The attackers' motive is clear: access to a broad range of information and systems that can be misused for further criminal activity, from identity theft to direct financial fraud. Once a user approves a consent request, things get dangerous: attackers often ask for specific permissions such as read access to email mailboxes or calendar entries.

Research by Microsoft shows that threat actors used third-party OAuth applications as their primary technique for exfiltrating data after victims had granted consent.

Consent dialog in Microsoft 365

Where blacklens.io helps

The best defence against consent phishing is a well-configured cloud environment with few privileged accounts. blacklens.io runs regular vulnerability scans in your cloud environment for this: through its Microsoft 365 and Azure connectors, the platform audits the configuration on a schedule and on demand. The identity inventory also shows which accounts hold privileged directory roles – the accounts whose consent is most valuable to attackers – which guest accounts exist and where MFA is missing.

The findings go into the same workflow as external and internal vulnerabilities, and notification policies route alerts to the responsible team by e-mail, push notification or integration. You should also review granted app permissions directly with your identity provider at regular intervals. Proactive measures are what work best against sophisticated phishing tactics, which is why blacklens.io starts with prevention rather than reaction.