How does an OAuth 'Consent Grant' phishing attack work with Google Sign-In?

A FAKE APP REQUESTS READ PERMISSIONS FOR EMAIL AND FILES, BYPASSING PASSWORD ENTRY.

Attackers create a third-party service and prompt you to log in using an official Single Sign-On (SSO) button. Upon confirmation, the user hands over a token with full access to messages, drive, and contacts to a malicious app.

Account Takeover Without Knowing the Victim's Password

In Illicit Consent Grant attacks, the user doesn't need to enter passwords on suspicious sites — the login window opens on the real Google, Microsoft, or Apple domain. The danger lies in the requested permissions: the malicious service requests advanced API rights allowing covert chat export even after changing the primary account password.

Ways to Protect Against Malicious Integrations

Carefully read the list of requested permissions before clicking confirm.
Periodically check and remove unused services in 'Third-party apps with account access'.
Limit Google Sign-In usage on unverified and new internet resources.
Set up system security notifications for new external client permission grants.