Definition
Consent phishing asks the user to approve an application rather than to reveal a credential. The authorization flow is legitimate; the application requesting it is not, or asks for far more than its function requires.
Why the usual response does not work
The standard reaction to account compromise is a password reset and forced re-authentication. A delegated grant is not a password. It can continue to function after the reset, because it was issued deliberately by the user and remains valid until it is specifically revoked.
That is what makes this a persistence technique rather than a one-time theft. The identity graph around the user outlives the credential.
What to examine
- Applications holding grants across the tenant
- Scopes broader than the application's stated function
- Grants issued by privileged or administrative users
- Publisher verification and application provenance
- Grants that persisted through a known credential event
- User
- OAuth Consent
- Malicious Application
- SaaS Access
- Sensitive Data
Each hop validated by successful exploitation
Tags
- oauth
- persistence
- identity