Emerging ConsentFix scams

You may be asked to sign in with your university account and then approve a request allowing an application to access your email, files, profile information, contacts, Teams data, or other Microsoft 365 content. Once approved, the application may be able to access this information without needing your password.

Spotting ConsentFix Attacks

Some ConsentFix attacks use a fake verification page that asks you to select Sign in, complete a genuine Microsoft sign-in process, and then copy, paste, submit, or drag+drop a web address (URL) displayed in your browser. Although the Microsoft sign-in page may be legitimate, the information returned afterwards can be used by cyber criminals to gain access to your account.

Legitimate university services will never ask you to copy, paste, share, or submit web browser addresses as part of a sign-in or verification process.

ConsentFix attacks can appear in a variety of ways such as:

• Emails inviting you to access a shared document or file.
• Requests to approve an application or grant permissions before viewing content.
• Surveys, forms, or questionnaires that unexpectedly request access to your Microsoft 365 account.
• Third-party productivity or collaboration applications requesting permissions that are unrelated to their stated purpose.
• Links shared through Teams, social media, or messaging platforms that lead to a consent request.
• Applications claiming to be HR, finance, procurement, or other business services.
• Online adverts promoting tools or services that require Microsoft 365 permissions before use.

Regardless of how you arrive at the request, never approve permissions for an application unless you understand what access is being requested, why it is required, and trust the source.

What can I do?

If you encounter a suspicious application consent request asking you to enter a URL to allow access, please stop immediately and use the reporting methods below so the Information Security Team can investigate and protect others.

Teams

If you receive a suspicious link or message in Microsoft Teams, use the Report option within Teams to alert the Information Security Team.

1. Go to the chat message and select More options ... > Report this message.
2. Choose the reason why you want to report the message. For example, use Security concern for reporting spam, phishing, or malicious content.
3. Select Report. You'll receive a message confirming your report was sent.

Emails

Use the Report Phishing button in Outlook.

Once reported, please do not delete the email. Keeping the message available allows the Information Security Team to investigate the reported content, identify any threats, and take appropriate action where necessary. Deleting the email can remove valuable evidence that helps identify malicious activity and apply protective security controls, helping to prevent similar attacks affecting others.

Websites and Application Consent Requests

Report it as a security incident on Beacon.

Where possible, include:

• The website address (URL).
• A brief description of your concerns.
• Screenshots of the consent request or application page.
• Information about how you reached the fake sign-in page.

If you approved the application or granted permissions before realising it was suspicious, report it immediately as a security incident and change your university account password. The Information Security Team can review the application's access, revoke unauthorised permissions where necessary, and take appropriate action to protect your account and University data.

Remember: Legitimate university services will never require you to copy, paste, share, or submit a URL as part of a sign-in, verification, or resource access process.

Please be especially cautious of unexpected requests that create a sense of urgency, such as claims that access to a document, shared file, survey, meeting, or service will be unavailable unless permissions are approved immediately. Cyber criminals often use urgency to pressure people into granting access without carefully reviewing what they are authorising.