CoPhish
A novel OAuth authorization phishing attack technique that exploits the trusted domains and interfaces of AI agent builder platforms. By registering malicious applications and initiating authorization requests, it bypasses the need to forge pages required in traditional phishing attacks, inducing users to grant sensitive permissions on legitimate platforms.
Timeline (last 90 days)
CoPhish is a new type of attack technique that exploits agent-building platforms themselves as attack vectors for OAuth authorization phishing.
CoPhish attacks do not require forging any pages; instead, they register malicious applications directly on the real platform and exploit the platform's own trusted domain name and interface appearance to initiate authorization requests.
Configuration strategies for defending against CoPhish include restricting applications that end users can independently authorize, verifying third-party application publishers, and minimizing the scope of token permissions.
Authorization fatigue amplifies CoPhish risks, because authorization requests become unusually frequent in the agent era, causing users' level of scrutiny to decline.
All Facts (4)
CoPhish is a new type of attack technique that exploits agent-building platforms themselves as attack vectors for OAuth authorization phishing.
50%UnverifiedCoPhish attacks do not require forging any pages; instead, they register malicious applications directly on the real platform and exploit the platform's own trusted domain name and interface appearance to initiate authorization requests.
50%UnverifiedConfiguration strategies for defending against CoPhish include restricting applications that end users can independently authorize, verifying third-party application publishers, and minimizing the scope of token permissions.
50%UnverifiedAuthorization fatigue amplifies CoPhish risks, because authorization requests become unusually frequent in the agent era, causing users' level of scrutiny to decline.
50%