Glossary: Monitoring Tools and the Identity Life Cycle

Consent phishing

An attack in which a harmless-looking app asks for broad OAuth scopes and tricks users into clicking Allow. No password is stolen, so a password reset doesn't remove the access; the app's tokens must be revoked.