OAuth Phishing

OAuth phishing is a social engineering technique that tricks a user or administrator into granting a malicious application access through an OAuth consent flow. The attacker does not always need a password. Instead, they exploit delegated authorization to obtain tokens, permissions, or persistent access to data and connected services.

Expanded Definition

OAuth phishing targets the authorization layer rather than the password layer. Instead of stealing credentials outright, the attacker persuades a user or administrator to approve a malicious application through an OAuth consent screen, then uses the resulting access token, refresh token, or delegated permission to act as that user within connected services. In practice, this is why OAuth phishing is often discussed alongside application consent abuse, token theft, and consent-grant persistence, although definitions vary across vendors when the attack chain includes additional post-consent abuse.

For NHI governance, the important distinction is that the malicious app may never learn the victim’s password, and traditional MFA does not stop a user from granting overly broad access if the consent prompt is trusted or poorly understood. Standards guidance on access control and least privilege, including NIST SP 800-53 Rev 5 Security and Privacy Controls, becomes relevant because the abuse often succeeds where consent review, app vetting, and token governance are weak. The most common misapplication is treating OAuth consent as a one-time convenience instead of a durable authorization grant, which occurs when organisations fail to review app scopes and revocation paths.

Examples and Use Cases

Implementing OAuth controls rigorously often introduces friction for users and administrators, requiring organisations to weigh access speed against consent risk, app review overhead, and token lifecycle management.

• A user clicks a convincing consent prompt for a fake productivity app, and the attacker receives delegated access to mailbox or file data without ever collecting the password.
• An administrator approves a suspicious enterprise app that requests broad directory or tenant permissions, creating persistent access that survives password resets until consent is revoked.
• A third-party integration is compromised, and the attacker uses its trusted OAuth relationship to pivot into downstream services, similar to patterns seen in the Klue OAuth Supply Chain Breach.
• A malicious assistant or workflow app requests access during a seemingly normal business process, echoing the token abuse pattern documented in CoPhish OAuth Token Theft via Copilot Studio.
• Security teams map high-risk app approvals against consent policies and identity controls, using external guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls to justify scope restrictions and periodic reviews.

NHIMG research shows that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which explains why consent-driven compromise often hides in plain sight. That visibility gap makes OAuth phishing harder to spot than password theft because the access path looks legitimate after the user approves it.

Why It Matters in NHI Security

OAuth phishing is an NHI issue because the attacker is not only impersonating a human user, but also hijacking the trust relationship between applications, service integrations, and the tokens that sustain them. In modern environments, those tokens frequently outlive the initial social engineering event and may grant access to sensitive data, automation pipelines, or connected SaaS systems. This is why consent governance, app allowlisting, token revocation, and monitoring of delegated access matter as much as credential hygiene.

NHIMG research also shows that 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage, underscoring how quickly token-based access can become a business event rather than a technical one. The lesson is reinforced by incidents such as the Salesloft OAuth token breach, where OAuth-based access became the entry point for downstream exposure, and by broader token abuse patterns documented in the State of Non-Human Identity Security. Organisationally, OAuth phishing becomes operationally unavoidable after a suspicious app approval is discovered in an audit, at which point token revocation and consent forensics are the only path to containing the blast radius.

Related resources from NHI Mgmt Group

• What breaks when OAuth consent phishing bypasses MFA and passkeys?
• What breaks when OAuth consent phishing happens inside the browser instead of at login?
• What breaks when OAuth phishing happens after a user already authenticated?
• Why do malicious OAuth apps create more risk than a simple phishing email?