The Phishing Attack That Doesn’t Need Your Password

Most of us have heard the same cybersecurity advice for years: use a strong password, turn on two-factor authentication, and never click suspicious links.

That is still good advice. The problem is that some newer phishing attacks are designed to work even when you follow those rules.

One of the more concerning examples is something called OAuth consent phishing. The name sounds technical, but the idea behind it is actually pretty simple. Instead of trying to steal your password, an attacker tries to convince you to give a malicious app permission to access your account.

And sometimes, all it takes is clicking “Allow.”

You Have Probably Used OAuth Without Knowing It

Any time you click a button that says “Sign in with Google” or “Sign in with Microsoft,” you are probably using OAuth.

It is a legitimate technology that allows one service to connect to another without forcing you to hand over your actual password. For example, a calendar app might ask permission to access your Google Calendar, or a photo app might ask permission to view files in your cloud storage.

Normally, that is convenient and relatively safe.

The trouble starts when the app asking for permission is not trustworthy.

What the Attack Looks Like

Imagine receiving an email that says someone shared an important document with you. The message looks normal, so you click the link.

You are taken to a Google or Microsoft login screen. Nothing seems unusual. You enter your password, complete two-factor authentication, and continue.

Then a permission window appears.

The app asks for access to your email, contacts, files, or calendar.

You click Allow.

At that point, the attacker may have exactly what they wanted.

The scary part is that your password may never have been stolen. The login page may even have been legitimate. Instead, you authorized an application to access parts of your account.

Why Two-Factor Authentication May Not Stop It

Two-factor authentication is one of the best protections available, but it is not designed to stop every type of attack.

In this case, you successfully authenticated yourself. The problem happens afterward, when the app asks for permission.

If a malicious app receives access to your email or files, changing your password may not automatically remove that permission. The app may continue to have access until you manually revoke it.

That is why these attacks can be so effective.

What You Can Do

The best defense is to treat permission screens with the same caution you would treat a password prompt.

Before clicking Allow, look closely at what the app is asking for.

Does a simple photo editor really need access to your contacts? Does a document viewer need permission to send email on your behalf? If the request seems excessive, cancel it.

It is also a good idea to periodically review the apps connected to your Google, Microsoft, Apple, and other important accounts. Remove anything you no longer use or do not recognize.

Most importantly, remember this: a familiar Google or Microsoft screen does not automatically mean the app behind it is safe.

Phishing is changing. Attackers do not always need your password anymore.

Sometimes, they just need your permission.