Phishing Series 2026: ConsentFix OAuth Illicit Consent Grant Requesting High-Privilege Scopes

Ibrahim Saud@tektrix

•updated 11 days ago•0•0•1

Detects instances where a user grants consent to an unverified OAuth application requesting high-privilege scopes (e.g., Mail.Read, Files.ReadWrite.All). This behavior is characteristic of consent phishing attacks aimed at obtaining persistent access to sensitive data and mailbox contents.