Malicious OAuth Consent Grant with High-Privilege Scopes (ConsentFix)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•6

Detects instances where a user grants an OAuth application permissions for high-privilege scopes such as 'mail.read', 'files.readwrite', or 'offline_access'. This behavior is frequently indicative of OAuth consent phishing campaigns targeting Microsoft Entra ID environments to gain unauthorized access to user data and maintain persistence via stolen access tokens.