What is consent phishing?¶
Consent phishing is a technique where a user is deceived into granting a malicious application permission to access a cloud account.
The attacker may not need the user’s password.
What this means in practice¶
In consent phishing, the user may be taken to the genuine cloud provider’s authorisation page. The page asks whether an application should be allowed to read files, access email, view contacts or perform other actions.
If the user approves the request, the provider issues tokens to the application. The attacker can then use those permissions through the application.
In a compromise investigation, identify which application received permission, who registered it, what access was granted and what data or actions followed.
Removing the application or revoking its consent may be necessary in addition to changing the password.
What this may show¶
Evidence may include application-consent records, application identifiers, permissions granted, token issue, IP addresses, sign-in events and later activity carried out by the application.
What this does not show on its own¶
The dangerous assumption is that phishing always involves a fake login page designed to steal credentials.
The application name and branding may look legitimate or closely resemble a trusted service. The requested permissions may also be presented in technical language that the user does not fully understand.
The user may have completed multi-factor authentication legitimately before granting consent. That does not make the later application activity authorised in the true sense if the consent was obtained by deception.
What to do next¶
Preserve the phishing message, link, authorisation screen, provider logs and any device artefacts connected to the consent event.
Key takeaway
Consent phishing abuses the cloud provider’s genuine permission process, so investigate the application, granted permissions and resulting token activity rather than looking only for stolen passwords.