⚠️ Awareness demo — fake OAuth consent screen. No permissions are granted.

Google

U

you@gmail.com

Choose another account

“Cool Productivity Helper” wants to access your Google Account

This will allow Cool Productivity Helper to:

📧 Read, compose, send, and permanently delete all your email from Gmail
📁 See, edit, create, and delete all your Google Drive files
📅 See, edit, share, and permanently delete all the calendars you can access using Google Calendar
👤 View your contacts
💬 See, edit, download, and permanently delete your contacts

Make sure you trust Cool Productivity Helper. You may be sharing sensitive info with this site or app.

🎣

Gotcha! This is OAuth consent phishing.

No permissions granted. This was a demo.

What just happened?

Consent phishing doesn't steal your password. It abuses the legitimate OAuth flow: a malicious app requests sweeping permissions to your Gmail, Drive, or Microsoft 365 account. If you click Allow, the attacker gets a long-lived token that bypasses your password and MFA. They can then read all your email, exfiltrate files, and impersonate you — silently.

Red flags:

Excessive scope. "Read, compose, send, and permanently delete all email" is not normal for a productivity tool.
Unverified / unknown app name. "Cool Productivity Helper" doesn't sound like a real vendor.
You didn't install this on purpose. Did you actively sign up? Or did you click a link?
The "make sure you trust" warning. Google shows it specifically because the app is unverified.

What to do:

Always review scopes carefully before clicking Allow.
Prefer apps verified by Google (they show a green check or say "verified").
Audit connected apps regularly: myaccount.google.com/permissions.
If you granted access by mistake: revoke immediately, change password, check Gmail filters (attackers add rules to auto-forward or delete).