Tag

Consent Phishing

All articles tagged with #consent phishing

technology3 days ago•6 min saved

Real Microsoft sign-in pages fuel consent phishing at scale

Cybersecurity researchers report attackers are using genuine Microsoft sign-in screens to run consent phishing, luring victims with HR-themed Teams emails and prompting approvals on real login pages. A single click grants attackers access to users’ email, Teams, SharePoint, OneDrive and calendar without stealing passwords, impacting about 120 organizations across various sectors in two weeks and evolving into an off-the-shelf service. Mitigations include hovering over links, verifying sender details, opening apps directly from official sources, enabling 2FA, and promptly reporting suspicious messages.

via cybernews.com|

#consent-phishing #cybersecurity #microsoft

technology2 months ago•6 min saved

Consent Phishing Turns OAuth Grants into Long-Lived Access Tokens

Security researchers warn that phishing via OAuth consent screens can bypass MFA by stealing refresh tokens, enabling attackers to access mail, drive, and calendars across Microsoft 365 tenants. EvilTokens reportedly compromised 340+ orgs in five countries by tricking users into approving scopes, leaving tokens valid for weeks or months unless explicitly revoked. The risk arises because consent flows sit outside traditional authentication controls and can bridge multiple apps—a 'toxic combination.' Mitigations include continuous OAuth/app inventory, monitoring grant age and re-consent, cross-application identity tracking, conditional access on consent events, and token-level revocation; platforms like Reco claim to map these grants to an identity graph for proactive detection and revocation.

via The Hacker News|

#consent-phishing #cross-application-integrations #mfa-bypass