Problem
Staff are trained to inspect links but not to verify unexpected OAuth permission requests.
Solution
Root Cause / Diagnostic:
Phishing campaigns increasingly bypass password collection entirely by tricking users into authorizing malicious third-party Google OAuth applications. These malicious apps request broad permissions (e.g., 'Manage your YouTube videos and account') that persist indefinitely without needing user credentials.
Actionable Fix:
1. Restrict third-party app access in Google Admin Console (Security > Access and data control > API controls > App access control) to explicitly trusted and whitelisted apps only.
2. Train production personnel to reject any unexpected OAuth consent screen requesting access to YouTube, Google Drive, or Google Account data.
3. Run an audit of all connected OAuth apps across all operational accounts and immediately revoke permissions for unverified or unused integrations.
Pro Tip:
Block non-admin users from granting consent to unverified third-party apps domain-wide by toggling Google Workspace user consent settings to 'Do not allow users to grant consent'.
Phishing campaigns increasingly bypass password collection entirely by tricking users into authorizing malicious third-party Google OAuth applications. These malicious apps request broad permissions (e.g., 'Manage your YouTube videos and account') that persist indefinitely without needing user credentials.
Actionable Fix:
1. Restrict third-party app access in Google Admin Console (Security > Access and data control > API controls > App access control) to explicitly trusted and whitelisted apps only.
2. Train production personnel to reject any unexpected OAuth consent screen requesting access to YouTube, Google Drive, or Google Account data.
3. Run an audit of all connected OAuth apps across all operational accounts and immediately revoke permissions for unverified or unused integrations.
Pro Tip:
Block non-admin users from granting consent to unverified third-party apps domain-wide by toggling Google Workspace user consent settings to 'Do not allow users to grant consent'.