a-rise-in-consent-phishing-attacks

A rise in consent phishing attacks

According to the 2020 Phishing and Fraud Report by F5, during the height of the global COVID-19 pandemic, phishing incidents had a growth of 220%. 

In addition to this, in the 2021 Must-know Phishing Statistics performed by Tessian, and in which Microsoft was part of the surveyed organizations, 37% of companies were a target of email phishing at least 11 times in 2020. 

There’s a certain type of phishing attacks that has risen in the past few months: Consent phishing attacks. These attacks abuse legitimate cloud service providers that use OAuth 2.0 authorization, such as Microsoft, Google, and Facebook. 

‘’OAuth 2.0 authorization is a widely used industry protocol that allows third party apps to access a user’s account and perform actions on their behalf’’ -Microsoft 365 Defender Threat Intelligence Team, 2021. 

The objective of consent phishing attacks is to trick users into granting access permission to the user’s cloud services. This specialized form of phishing requires a multi-layer defense, which is why system administrators must gain visibility and control over apps and permissions.  

How to fight consent phishing attacks? 

Security administrators can prevent, detect, and respond to these threats with the help of Microsoft Defender for Microsoft 365. 

MS 365 Defender coordinates defense across domains, making use of a variety of solutions, such as: 

  • Microsoft Defender for MS 365 to block consent phishing emails.
  • Microsoft Cloud App Security to identify malicious apps. 
  • Azure Active Directory (AD) to prevent consent for illegitimate apps. 

These are just to name a few, however, there are numerous solutions and options for administrators to fight and prevent these attacks. If you want to know more about these or further solutions, read this article. 

Users and security administrators must stay alert for these and other types of phishing attacks. Remember that security is a combination of processes, policies, and controls. Our Microsoft experts can help your organization implement the latest Microsoft security solutions and best practices. Please reach out for more information on our Microsoft Cloud Security Services.