The New Phishing Click: How OAuth Consent Bypasses MFA

OAuth consent screens have become a primary phishing vector that bypasses MFA, as demonstrated by EvilTokens, which compromised 340+ Microsoft 365 organizations by harvesting refresh tokens.

• •EvilTokens distributed fake device-login prompts directing users to complete MFA on legitimate identity providers, then captured long-lived refresh tokens with access to mail, drive, calendar and contacts
• •Refresh tokens persist after password resets and remain valid for weeks or months without explicit revocation, unlike traditional credential phishing requiring password replay
• •Users habitually click through consent screens, making malicious OAuth requests indistinguishable from legitimate app integrations and AI agent permissions at scale
• •Toxic combinations form when OAuth grants across multiple unrelated SaaS applications create interconnected risks no single application owner authorized or can audit