|
| 1 | + |
| 2 | +<!DOCTYPE html> |
| 3 | +<html lang="en"> |
| 4 | +<head> |
| 5 | + <meta charset="UTF-8" /> |
| 6 | + <title>Security Awareness Simulation – Consent Phishing</title> |
| 7 | + <meta name="viewport" content="width=device-width, initial-scale=1" /> |
| 8 | + <style> |
| 9 | + body { font-family: Segoe UI, Arial, sans-serif; background:#0F172A; color:#F9FAFB; margin:0; } |
| 10 | + .container { max-width: 800px; margin: 40px auto; background:#1E293B; padding:30px; border-radius:12px; box-shadow:0 8px 24px rgba(0,0,0,0.4); } |
| 11 | + h1 { color:#38BDF8; margin-top:0; } |
| 12 | + p { line-height:1.6; font-size:18px; } |
| 13 | + .alert { background:#F87171; color:#0F172A; padding:12px; border-radius:8px; font-weight:700; margin:20px 0; } |
| 14 | + ul { padding-left:20px; } |
| 15 | + li { margin-bottom:8px; } |
| 16 | + code { background:#0B1020; padding:2px 6px; border-radius:6px; } |
| 17 | + footer { text-align:center; color:#94A3B8; font-size:14px; margin-top:40px; } |
| 18 | + </style> |
| 19 | +</head> |
| 20 | +<body> |
| 21 | + <div class="container"> |
| 22 | + <h1>Consent Phishing Simulation</h1> |
| 23 | + <div class="alert">⚠️ This was a simulation – no credentials were captured.</div> |
| 24 | + <p>You interacted with a multi-tenant application that requested access via Microsoft’s real sign-in page.</p> |
| 25 | + <h2>What this demonstrates</h2> |
| 26 | + <ul> |
| 27 | + <li>Attackers register apps in their own tenant and make them <strong>multi-tenant</strong>.</li> |
| 28 | + <li>They ask for dangerous permissions like <code>Mail.Read</code>, <code>Files.Read</code>, and <code>offline_access</code>.</li> |
| 29 | + <li>If consent is granted, attackers can access data and <strong>persist</strong> using refresh tokens until consent is revoked.</li> |
| 30 | + </ul> |
| 31 | + <h2>How to protect yourself</h2> |
| 32 | + <ul> |
| 33 | + <li>Verify the <strong>publisher</strong> and look for <strong>verified publisher</strong> badges.</li> |
| 34 | + <li>Scrutinize the <strong>permissions</strong> and ask: do they match the task?</li> |
| 35 | + <li>If uncertain, <strong>cancel</strong> and report to IT Security.</li> |
| 36 | + </ul> |
| 37 | + </div> |
| 38 | + <footer>© 2025 Security Awareness Program | Controlled simulation for training purposes.</footer> |
| 39 | +</body> |
| 40 | +</html> |
0 commit comments