Attackers are going after prominent individuals through OAuth phishing, FBI warns
FBI IC3 warns of ongoing OAuth consent phishing since late 2025 targeting prominent individuals to gain persistent, password-free account access.
Attackers register malicious applications with legitimate OAuth providers, impersonate journalists, academics, event organizers, or government officials on messaging apps and email, and lure targets into approving permission requests on real Microsoft or Google login pages. Once approved, the attacker's application can read and send emails and access sensitive files within granted permissions, bypassing both passwords and MFA. The FBI notes password changes do not revoke this access; victims must invalidate the OAuth token in application security settings, and no attribution or victim list has been disclosed.
- Malicious apps are named to resemble third-party storage or identity verification services.
- Access persists through OAuth tokens; password changes do not revoke it, only token revocation does.
- Targets include prominent individuals, their relatives, and personal contacts.
- Activity ongoing since late 2025; links often delivered via commercial messaging apps.
Full article365 words · extracted from helpnetsecurity.com · click to collapse
Attackers are targeting prominent individuals, their relatives and personal contacts to gain persistent access to their accounts, including private emails and files, the FBI has warned.
The FBI’s Internet Crime Complaint Center (IC3) says the activity, which uses a technique called “OAuth consent phishing,” has been ongoing since late 2025. The FBI describes it as “a deceptive, sophisticated approach to access user accounts without requiring a password.”
OAuth is a framework that lets one application request access to a user’s account on another service without the user handing over login credentials directly.
“Recently observed activity includes impersonating government officials, media, and other publicly known personalities on a commercial messaging application (CMA) and soliciting the targeted individual to access a malicious link under the guise of a file sharing service through an application under the malicious actor’s control,” the FBI wrote in its advisory.
According to authorities, attackers register a malicious application with a legitimate OAuth provider and may name it to resemble a “third-party personal storage or identity verification service.”
They then contact targets through a commercial messaging app or email, posing as a journalist, academic, or event organizer, asking the target to review a document or confirm their identity through the application.
The link takes the victim to a genuine login page belonging to the service provider, such as Microsoft or Google.
Once the victim approves the permission request, the attacker’s application gains access to the account within the permissions granted. From that point, the attacker can act as the victim, reading and sending emails and accessing sensitive data, without ever needing the victim’s password.
The FBI notes that a password change does not revoke this access. The victim must invalidate the token through their application security settings.
“By registering malicious applications through legitimate authorization protocols and using social engineering tactics, cyber actors can bypass both passwords and multi-factor authentication, which makes consent phishing especially dangerous,” the FBI warns.
The FBI advises increased scrutiny of messages from unfamiliar phone numbers or accounts and recommends independently verifying a sender’s identity. It also advises granting authorization only to trusted applications.
The FBI has not disclosed who is behind the attacks or who the victims are.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/02/oauth-consent-phishing-fbi-warning/