You receive an email containing a link to view a document, install a tool or access a service.<\/p>\n
You click it. The genuine Microsoft or Google sign-in page appears. You log in as usual and complete multifactor authentication.<\/p>\n
Everything looks legitimate.<\/p>\n
Then, another screen asks for permission to read your email, access your files, view your contacts or maintain access to your account.<\/p>\n
You click \u201cAllow.\u201d<\/p>\n
The attacker did not need to steal your password. You authorized the access yourself.<\/p>\n
When we sign in, we prove who we are. That is authentication.<\/p>\n
When we allow an application to access certain data or perform actions on our behalf, that is authorization.<\/p>\n
Services such as Microsoft 365 and Google Workspace allow us to connect external applications without sharing our passwords directly. Instead, the application receives limited access (represented by a token) to the resources the user has authorized.<\/p>\n
This is a legitimate and useful mechanism. It enables us to connect calendars, productivity tools, document managers and many other services.<\/p>\n
The problem arises when a malicious application persuades us to grant those permissions.<\/p>\n
In traditional phishing, attackers often create a fake website to capture usernames and passwords.<\/p>\n
In consent phishing, the sign-in page may be completely genuine. The address may really belong to Microsoft or Google, and multifactor authentication may work exactly as expected.<\/p>\n
The deception is not necessarily on the page where we authenticate. It lies in the application requesting access and in the permissions we are about to grant.<\/p>\n
This can create a false sense of security:<\/p>\n
\u201cThe page is official, so it must be safe.\u201d<\/p><\/blockquote>\n
But a legitimate platform does not automatically make the connected application trustworthy.<\/p>\n
What Can an Authorized Application Do?<\/h2>\n
That depends on the permissions granted. An application may request the ability to:<\/p>\n
\n
- Read your email.<\/li>\n
- View or modify your files.<\/li>\n
- Access your contacts and calendars.<\/li>\n
- Send messages on your behalf.<\/li>\n
- View your profile information.<\/li>\n
- Maintain access even when you are no longer using the application.<\/li>\n<\/ul>\n
These permissions are not inherently dangerous. Many legitimate applications need them to function.<\/p>\n
The warning sign appears when the access requested is excessive, unexpected or unrelated to the service being offered.<\/p>\n
A tool that claims to let you view a single document should not normally require permanent access to your entire mailbox.<\/p>\n
What to Check Before Clicking \u201cAllow\u201d<\/h2>\n
Before authorizing an application, pause for a few seconds and check:<\/p>\n
\n
- Who is requesting access. Review the name of the application and its developer. Be cautious with generic names or names that closely imitate familiar services.<\/li>\n
- How you reached the page. A request opened through an unexpected email, urgent message or chat link deserves particular scrutiny.<\/li>\n
- Which permissions are being requested. Read the full list. Do not stop after confirming that the page belongs to Microsoft or Google.<\/li>\n
- Whether the permissions are proportionate. Ask whether the application genuinely needs that level of access to do what it promises.<\/li>\n
- Whether you are being pressured to act quickly. Urgency is commonly used to make people approve requests without thinking.<\/li>\n<\/ol>\n
If something does not make sense, cancel the request. Access the service through its official website or ask your support team to verify it.<\/p>\n
Changing the Password May Not Be Enough<\/h2>\n
When we suspect that an account has been compromised, our first reaction is usually to change the password.<\/p>\n
That is a sensible measure, but in this case it may not solve the entire problem.<\/p>\n
Once an application has been authorized, it may retain a token that allows it to continue accessing certain resources without needing the new password.<\/p>\n
You should also:<\/p>\n
\n
- Review the applications connected to the account.<\/li>\n
- Revoke any authorization you do not recognize.<\/li>\n
- Check the permissions already granted.<\/li>\n
- Review recent activity and active sessions.<\/li>\n
- Report the incident to the security team if it involves a professional or institutional account.<\/li>\n<\/ul>\n
The password protects the sign-in process. Permissions determine what an application can do once it has been allowed inside.<\/p>\n
Before Authorizing, Look Beyond the Domain<\/h2>\n
Checking the address of a webpage remains important, but it is no longer always enough.<\/p>\n
A legitimate screen can present a dangerous request. Multifactor authentication may confirm that you are really you, but it cannot decide whether the application deserves your trust.<\/p>\n
That decision is still yours.<\/p>\n
The next time an application asks to access your email, files, contacts or calendar, do not click \u201cAllow\u201d automatically.<\/p>\n
Check who is asking, which permissions are being requested and what the application will be able to do on your behalf.<\/p>\n","protected":false},"excerpt":{"rendered":"
A legitimate sign-in page does not guarantee that an authorization request is safe. Learn how consent phishing can access your email, files or contacts without stealing your password.<\/p>\n","protected":false},"author":8,"featured_media":3836,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[69,78,77,70,76,73,75],"class_list":["post-3837","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tips","tag-account-security","tag-connected-applications","tag-consent-phishing","tag-digital-identity","tag-identidad-digital","tag-oauth","tag-seguridad-de-cuentas"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t