Not every account takeover begins with a fake password box.
Sometimes the dangerous button really does belong to Microsoft, Google, or another legitimate identity provider.
OAuth exists so one application can request limited access to another service without learning the user’s password. That is useful when a calendar app needs calendar access or a legitimate productivity tool needs permission to read files.
The same mechanism can be abused.
Microsoft describes “consent phishing” attacks in which an attacker creates an application that looks plausible, sends a victim to a genuine consent screen, and asks the victim to approve permissions. If the victim selects Accept, the application can receive tokens that let it access the data covered by those permissions.
See Microsoft’s guidance on protecting against consent phishing and its incident-response playbook for app consent grants.
The password can remain secret
That is what makes this scam different from ordinary credential phishing.
The account password may never be typed into a fake page. Multi-factor authentication may not be defeated. The user instead authorizes the malicious application through the provider’s real permission system.
Microsoft notes that granted permissions can expose resources such as email, files, contacts, notes, and profile information depending on what the application requested.
The question on the consent screen is therefore not merely, “Is this Microsoft?”
It is, “What is this application, and why does it need these permissions?”
Read the scope, not just the logo
A familiar sign-in page can make the process feel safe because the identity provider itself is genuine. The requesting application is the part that deserves scrutiny.
Check the application’s name and publisher. Read the actual permission list. A simple utility asking to read and write mail, maintain offline access, or reach large parts of an organization’s data should not be waved through because the screen looks official.
If an unfamiliar application has already been granted access, removing or disabling the app’s permissions is part of recovery. In an organization, administrators may also need to investigate what the application accessed and whether other users consented to it.
OAuth solves a real problem: sharing access without sharing passwords.
Consent phishing exploits the same improvement.
The password stays private while the victim accidentally hands over the key to everything the requested permissions cover.