OAuth Consent Phishing

    Read What You Are Allowing

    Apps that ask to “read your mail” or “access your files” can keep that access even after you change your password.

    Everyday Cyber SafetyEveryday usersIT & help deskDevelopers

    Illustrative scenario

    How It Looks in Real Life

    A link opens your real Microsoft or Google sign-in. After signing in, an app called “Secure Doc Viewer” asks permission to read your email and access your files.

    Understand it

    How the Attack Works

    Instead of stealing your password, the attacker registers an app and tricks you into granting it permissions. The sign-in page is genuine, so it feels safe, but the app receives a token that keeps working after a password change.

    Red flags

    Warning Signs

    • An unfamiliar app requesting broad access such as reading all email or files.
    • Permission requests that do not match what you were trying to do.
    • Unverified publisher labels or misspelled app names.

    Safer habits

    What to Do Instead

    • 1Decline requests you do not understand and ask IT which apps are approved.
    • 2Use only organisation-approved apps for work data.
    • 3Review your connected apps regularly and remove those you do not use.

    Response playbook

    Already Interacted?

    For work accounts and devices, report promptly through your organisation’s IT or security process first. Never share passwords, codes or tokens in a report.

    If you: approved app permissions or a sign-in request
    1. 1Report it straight away so IT can revoke the session or app consent.
    2. 2Remove the unfamiliar app from your account’s connected apps or permissions page.
    3. 3Changing your password does not remove app permissions or tokens already issued.

    Knowledge Check

    What Would You Do?

    A “PDF viewer” wants permission to “Read, send and delete your mail”. You only wanted to view a document. What do you do?

    Fictional example for learning. Not a test score or certification.

    Sources

    Content reviewed by WazuGuardix on 5 October 2026. Summaries are in our own words.

    All Awareness Guides

    Make Safe Habits Part of Your Culture

    Plain-language awareness sessions for everyday staff, developers and business teams.

    Email Us