{"id":21000,"date":"2022-02-18T09:43:41","date_gmt":"2022-02-18T09:43:41","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=21000"},"modified":"2026-03-13T13:23:16","modified_gmt":"2026-03-13T13:23:16","slug":"what-is-consent-phishing-and-how-to-prevent-such-attacks","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/what-is-consent-phishing-and-how-to-prevent-such-attacks\/","title":{"rendered":"What Is Consent Phishing and How to Prevent Such Attacks?"},"content":{"rendered":"

If you\u2019ve ever been interested in cybersecurity, you\u2019ve probably heard of <\/span>consent phishing<\/b>. Well, the term itself hints at its exact essence. This specific kind of cyberattack requires consent of sorts from the victim. It <\/span>has recently grown<\/span><\/a> across the globe sending an invisible message to countless businesses: Revise your user policies and digital asset management.<\/span><\/p>\n

This article dives into <\/span>what consent phishing<\/b> is so that both organizations and individuals can better protect their data from this targeted attack.\u00a0<\/span><\/p>\n

What is Consent Phishing?<\/b><\/h2>\n

Consent phishing <\/b>is an application-based attack that misleads the victim with a legitimately registered application to get access to their sensitive data. This attack type, however, differs from credential phishing, as it doesn\u2019t redirect the user to a fake app.<\/span><\/p>\n

While it can be implemented in various ways, the most common one is via email. So how does <\/span>consent phishing<\/b> happen? The attacker sends a seemingly reliable message to their target\u2019s email. Once the target clicks on the link, an application is installed on their computer. From there, the attacker harvests information about the victim.<\/span><\/p>\n

Consent Phishing Example<\/b><\/h3>\n

There have been many vivid cases of <\/span>consent phishing attacks<\/b> among prominent organizations that later turned into a warning signal for others.<\/span><\/p>\n

One of the most famous examples is the <\/span>security breach<\/span> SANS Institute disclosed in 2020. As they reported, some employees received an email named \u201cCopy of sans July Bonus 24JUL2020.xls\u201d.\u00a0<\/span><\/p>\n

It included a \u201cBonus\u201d document in the Enabler4Excel 365 format and employees felt excited to click on the \u201cOpen\u201d button. It was enough for one employee to click the link and inadvertently install a malicious Microsoft 365 add-on. This program created a forwarding rule for 513 emails to the anonymous attacker.<\/span><\/p>\n

How Do Consent Phishing Attacks Work?<\/b><\/h2>\n

To be trustworthy enough,<\/span> consent phishing attacks<\/b> seemingly come from <\/span>legitimate providers. This makes it easier for attacker-controlled applications<\/span> to gain access to user data. The plan is usually meticulously orchestrated to achieve success. Below, we talk about the common steps <\/span>consent phishing attacks<\/b> follow.\u00a0<\/span><\/p>\n

The Consent Phishing Method<\/b><\/h3>\n

Each consent phishing attack is different, but the main steps remain as follows:<\/span><\/p>\n