FBI raises alarm over deceptive phishing campaign targeting prominent people
The FBI warns of an ongoing OAuth consent phishing campaign granting attackers persistent access to high-profile victims' cloud accounts without passwords.
The FBI says attackers impersonate government officials, journalists and event coordinators on commercial messaging apps to trick prominent individuals, their families and acquaintances into authorizing malicious OAuth applications on Microsoft or Google cloud services. Once approved, attackers gain persistent access to emails, files and other sensitive data; the access survives password changes and bypasses MFA, and can only be revoked by invalidating the OAuth token in security settings. The campaign has been tracked since late 2025, and the FBI advises independently verifying senders and granting access only to trusted applications.
- OAuth consent phishing grants persistent account access without passwords or MFA
- Actors impersonated government officials, journalists and event coordinators as lures
- Access persists until the victim invalidates OAuth tokens in app security settings
- Attackers gain visibility into configured permissions, emails and files
- FBI has tracked the campaign since late 2025
- Victims
- High-profile individuals
- Organizations
- FBI
From the original article
3 min read at cyberscoop.com
The ongoing social engineering threat, which dates back to late 2025, tricks victims into granting threat actors long-term access to their accounts. The headquarters of the Federal Bureau of Investigation on August 16, 2022, in Washington.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.