OAuth consent phishing: are your controls keeping up?

TL;DR: OAuth consent phishing is rising because attackers use legitimate Microsoft and Google authorization flows to obtain API access without stealing passwords, and MFA often does not stop the abuse, according to Hoxhunt. The real control gap is consent governance, not authentication strength, because approved tokens can persist until revoked.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “OAuth Consent Phishing: Why It’s Rising & How Awareness Programs Stop It”.

Key questions

Q: What breaks when users are allowed to approve OAuth apps freely?

A: When users can approve OAuth applications without tight governance, a single click can create long-lived delegated access to mail, files, chat, and APIs.

Q: Why do malicious OAuth apps still work even when organisations use MFA?

A: They work because the attack targets the authentication session, not just the password.

Q: What are the warning signs that OAuth consent is being abused?

A: Warning signs include unexpected app registrations, broad scopes that do not match user role, consent events from unmanaged devices, and access patterns that continue after the original user interaction.

Practitioner guidance

• Limit user consent by default Require admin approval for new OAuth app grants, especially for scopes that can read mail, send messages, or access files.
• Restrict high-risk OAuth scopes Block unverified or look-alike applications and require publisher verification where it is available to reduce impersonation risk.
• Review and revoke stale tokens Continuously monitor enterprise app consent events and remove OAuth tokens that are unnecessary, unrecognised, or no longer justified.

Bottom line: OAuth consent phishing exploits legitimate authorisation flows, so the security failure sits in delegated access rather than password compromise.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →