Identity & Access
OAuth & Token Abuse
Third-party app integrations grant persistent cloud access without requiring passwords.
What it is
Consent phishing tricks users into granting OAuth permissions to malicious applications registered in legitimate cloud tenants. Once granted, the attacker has persistent access to mailboxes, files, and calendars without needing credentials and without triggering MFA. Refresh tokens persist indefinitely unless explicitly revoked.
Attack techniques
- OAuth Application Consent Phishing
- Steal Application Access Token (T1528)
- Forge Web Credentials — OAuth Token (T1606.001)
- Abuse of registered Azure AD / Entra app permissions
Business impact
OAuth abuse produces no failed login events and no password compromise. Standard monitoring for credential theft misses it entirely. Access persists until the token or application registration is revoked.