Sep 3rd, 2025 -

The Rise of Consent Phishing and How to Defend Against It

What is Consent Phishing?

Consent phishing is a sophisticated cyber attack where criminals trick users into granting malicious applications access to their data—without ever stealing their password. Instead of asking for login credentials, attackers present a legitimate-looking app and request permissions to access email, files, or contacts. Once granted, the attacker can exploit this access for data theft, fraud, or further attacks.

Why is Consent Phishing on the Rise?

Cloud Adoption: As more organisations move to cloud platforms like Microsoft 365 and Google Workspace, attackers target the permissions model instead of passwords.
Bypassing MFA: Consent phishing can bypass multi-factor authentication (MFA), since users are tricked into granting access directly.
Convincing Apps: Attackers use realistic app names, icons, and descriptions to appear trustworthy.
Low User Awareness: Many users don’t realise the risks of granting app permissions, making them vulnerable to these attacks.

How to Spot Consent Phishing

Unexpected prompts to grant permissions to an app you didn’t request.
Requests for broad access (e.g., “Read all your emails” or “Access all files in your drive”).
App names or publishers that don’t match your organisation or known vendors.
Urgent or suspicious messages encouraging you to approve access quickly.

How to Defend Against Consent Phishing

1. Educate Your Users

Include consent phishing in your security awareness training. Teach users to:

Recognise suspicious consent screens
Verify app legitimacy
Understand the risks of granting permissions

2. Use Phishing-Resistant MFA

Implement FIDO2 security keys or certificate-based authentication to reduce token theft risk.

3. Audit App Permissions

Regularly review OAuth apps connected to your environment. Remove unused or suspicious apps using tools like Microsoft Entra or Google Admin Console.

4. Deploy Advanced Threat Protection

Use email security platforms that detect payload-free phishing and intent-based threats. Look for solutions with semantic analysis and behavioural detection.

5. Enforce Conditional Access

Limit app access based on user roles, device compliance, and location. This adds friction for attackers.

6. Monitor for Anomalies

Use security tools to detect unusual API calls or data access patterns. Real-time alerts can help stop attacks early.

Quick Tip

Always check the permissions an app is requesting. If in doubt, contact your IT or security team before granting access.

How Reflective IT Can Help

At Reflective IT, we help organisations defend against the latest threats—including consent phishing. Our services include user awareness training, cloud security configuration, and continuous monitoring to keep your data safe.