Attackers are going after prominent individuals through OAuth phishing, FBI warns
FBI IC3 warns of ongoing OAuth consent phishing since late 2025 targeting prominent individuals to gain persistent, password-free account access.
Attackers register malicious applications with legitimate OAuth providers, impersonate journalists, academics, event organizers, or government officials on messaging apps and email, and lure targets into approving permission requests on real Microsoft or Google login pages. Once approved, the attacker's application can read and send emails and access sensitive files within granted permissions, bypassing both passwords and MFA. The FBI notes password changes do not revoke this access; victims must invalidate the OAuth token in application security settings, and no attribution or victim list has been disclosed.
- Malicious apps are named to resemble third-party storage or identity verification services.
- Access persists through OAuth tokens; password changes do not revoke it, only token revocation does.
- Targets include prominent individuals, their relatives, and personal contacts.
- Activity ongoing since late 2025; links often delivered via commercial messaging apps.
- Organizations
- FBIInternet Crime Complaint Center (IC3)
From the original article
2 min read at helpnetsecurity.com
Attackers are targeting prominent individuals, their relatives and personal contacts to gain persistent access to their accounts, including private emails and files, the FBI has warned. The FBI’s Internet Crime Complaint Center (IC3) says the activity, which uses a technique called “OAuth consent phishing,” has been ongoing since late 2025.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.