Ah, OAuth 2.0. The protocol that promised to end password reuse and save us from the deep, dark, insecure corners of the web. The one we thought would be the antidote to phishing. But guess what?
Surprise! The hackers have also read the docs.
Let’s dive into how OAuth 2.0 — your “secure” login buddy — can be twisted into a tool of digital robbery.
First, What Is OAuth 2.0?
OAuth 2.0 is like saying:
"Hey Google, can I borrow Steve’s login info for a second? I swear I won’t peek at his emails."
Instead of passwords, it uses access tokens — digital permission slips that say, “Yes, this app is allowed to poke around your stuff.”
It’s the magic behind those buttons that say:
"Log in with Google / Facebook / GitHub / [Insert Tech Monolith Here]"
Now Enter: OAuth 2.0 Phishing
OAuth phishing isn’t your grandmother’s “Please reset your PayPal password” scam.
This is a sleek, modern attack where:
- You click “Log in with Google” on a legit-looking app.
- It does go to Google’s real OAuth screen.
- You say “Sure, whatever,” and click Allow.
- BAM! You’ve just handed a hacker permission to access your account… without ever giving them your password.
“Wait, what?!?” You may be thinking.
But Wait... How Is That Phishing?
Because the malicious app is the attacker.
"But it had a cute name! And a green padlock!"
Exactly. That app was registered with a name like "Google Docs Fast™" or "Invoice Portal Pro" and requested scary permissions like:
- Read your emails
- Access your files
- Control your soul (okay, maybe not yet)
Once you approved, the attacker got an access token — your golden ticket — and didn’t need your password. No 2FA. No suspicious login alerts. Just... open sesame.
The Techie Breakdown
Here’s how the OAuth scam sausage is made:
- Attacker registers a malicious OAuth app on Google, Microsoft, or GitHub.
- Sends phishing email or link that lures the victim to the app's “Login with [provider]” page.
- User grants scopes (permissions) like read:emails, files.read, cloud.write, and unleash:chaos.
- OAuth provider redirects with an access token.
- Attacker uses that token to pillage your digital village.
All perfectly legal from the API’s perspective.
What Makes This Worse?
- The OAuth screen doesn’t always show you the full list of permissions. It’s like agreeing to a 200-page EULA after reading just one line: “We pinky promise not to break stuff.”
- Users trust “Login with Google” like it’s a blood oath.
- Revoking tokens? Hidden deep in the “Click 9 times to find it” settings menu.
How to Not Be a Token Donor
- Don’t blindly click “Allow.”
If you don’t recognize the app name or it asks to access your nuclear codes, maybe don’t? But also, take a little extra time to verify the access being requested fits the app.
- Use security admin tools (if you're in an org).
Google Workspace and Microsoft 365 let you restrict or block third-party OAuth apps or only allow administrators to approve.
- Regularly review connected apps.
Treat it like spring cleaning. Only less fun. Here’s a couple spots to start:
A. Google (personal/work/school)
i. https://myaccount.google.com/permissions
ii. Sign in with your Google account (if not already signed in).
iii. You’ll see a list of third-party apps and sites that have access to your account.
iv. Click on any app to see:
a. What data it can access (e.g., email, contacts, Drive files)
b. When access was granted
c. To remove access, click the "Remove Access" button.
B. Microsoft (personal and work/school)
i. For Personal Microsoft Accounts (Outlook.com, Hotmail, etc.):
a. Go to the Microsoft account permissions page: https://account.live.com/consent/Manage
b. Sign in with your Microsoft account.
c. You’ll see a list of apps and services that have access to parts of your Microsoft account via OAuth.
d. Click "Edit" or "Remove" next to any app to revoke its permissions.
ii. For Work or School Accounts (Microsoft 365 / Azure AD / Entra ID):
a. Go to the Microsoft Entra My Access portal:
https://myaccount.microsoft.com/
b. Navigate to "Privacy & data" > "Apps and services"
Or go to:
https://myapps.microsoft.com/
Or: https://entra.microsoft.com/ and select "My Access"
c. You’ll see a list of applications that:
I. You’ve signed into
II. Have access to your organization’s data
III. Were granted permissions via OAuth
IV. Click on any app to:
1. View permissions (such as Mail.Read, Files.Read, etc.)
2. Revoke access (look for a "Remove" or "Revoke permissions" option)
4. Train your team.
If Chad from Sales installs “Sexy Invoice Tool 3000,” you’ll want to know before your entire client list ends up in a data dump on the dark web.
TL;DR (Too Lazy; Definitely Regret It Later)
OAuth 2.0 is great.
Until you give access to the wrong app.
Then it’s like lending your keys to a burglar in a suit.
So yeah — OAuth phishing: It’s not your password they want. It’s your tokens.
It’s elegant. It's sneaky. And it’s exactly the kind of attack that makes you scream into your coffee mug at 9:00 a.m.
Final Thought
Next time someone tells you “OAuth is secure,” just nod and say:
"Sure. It’s secure. Until it’s not. Just like my sanity."
LookingPoint offers multiple IT services if you’re interested. Want more information, give us a call! Please reach out to us at sales@lookingpoint.com and we’ll be happy to help!