The New Phishing Click: How OAuth Consent Bypasses MFA

"Within five weeks, it had compromised more than 340 Microsoft 365 organizations across five countries. The targets of the platform received a message asking them to enter a short code at microsoft.com/devicelogin and complete their normal MFA challenge, then walked away believing they had verified a routine sign-in. They had actually handed the operator a valid refresh token scoped to their mailbox, drive, calendar, and contacts, with the lifespan of a tenant policy rather than a session."

"The operator never needed a password, never tripped an MFA prompt, and never produced a sign-in event that looked like an intrusion. The attack succeeded because the OAuth consent screen has become an instinctive click, and the controls built to stop credential phishing do not look at the consent layer. Security researchers call the resulting condition consent phishing or OAuth grant abuse."

"A credential phish hands over a username and password that has to be replayed somewhere, and most identity stacks now demand a second factor at the replay. Even adversary-in-the-middle (AiTM) kits produce a session cookie tied to a sign-in event that the SIEM correlates against geography, device, and travel patterns. An OAuth grant produces no replayed credentials."

"The user authenticates on the legitimate identity provider, finishes the MFA challenge on the legitimate domain, and clicks Accept. The token the attacker walks away with is the system working as designed. It is signed by the identity provider, scoped to whatever the user agreed to, and refreshable. MFA cannot block it because MFA has already happened."

EvilTokens, a phishing-as-a-service platform, launched in February 2026 and compromised over 340 Microsoft 365 organizations within five weeks across five countries. Victims received messages instructing them to enter a short code at microsoft.com/devicelogin and complete their normal MFA challenge, then leave. The process resulted in the attacker obtaining a valid refresh token scoped to mailbox, drive, calendar, and contacts, with a lifespan governed by tenant policy rather than a short session. The attacker did not need passwords, did not trigger MFA prompts, and did not generate sign-in events that appeared intrusive. The success came from OAuth consent screens being clicked instinctively and existing anti-phishing controls not examining the consent layer.

Read at The Hacker News