45
30
45
30
30
45
30
45
45
30
Attackers are going after prominent individuals through OAuth phishing, FBI warns
FBI IC3 warns of ongoing OAuth consent phishing since late 2025 targeting prominent individuals to gain persistent, password-free account access.
Attackers register malicious applications with legitimate OAuth providers, impersonate journalists, academics, event organizers, or government officials on messaging apps and email, and lure targets into approving permission requests on real Microsoft or Google login pages. Once approved, the attacker's application can read and send emails and access sensitive files within granted permissions, bypassing both passwords and MFA. The FBI notes password changes do not revoke this access; victims must invalidate the OAuth token in application security settings, and no attribution or victim list has been disclosed.
60
30
30
30
45
30
30
45
30
30
FBI raises alarm over deceptive phishing campaign targeting prominent people
The FBI warns of an ongoing OAuth consent phishing campaign granting attackers persistent access to high-profile victims' cloud accounts without passwords.
The FBI says attackers impersonate government officials, journalists and event coordinators on commercial messaging apps to trick prominent individuals, their families and acquaintances into authorizing malicious OAuth applications on Microsoft or Google cloud services. Once approved, attackers gain persistent access to emails, files and other sensitive data; the access survives password changes and bypasses MFA, and can only be revoked by invalidating the OAuth token in security settings. The campaign has been tracked since late 2025, and the FBI advises independently verifying senders and granting access only to trusted applications.
62
45
45
30
45
30
45
45
30
45
30
50
45
45
30
30
FBI: Hackers using social engineering to breach accounts and steal explicit content
FBI warns hackers use social engineering and password-stuffing to hijack social media accounts and sell victims' explicit content on criminal marketplaces.
The FBI issued an alert on threat actors who breach social media accounts of adults and children using password-stuffing with credentials from data leak sites, impersonation of social media support staff, and cloned login pages, in order to steal and sell explicit content. Stolen content is often posted with victims' personal information, leading to sextortion, harassment, and stalking. Related DOJ cases include a man who pleaded guilty to hacking about 600 Snapchat accounts and a former University of Michigan coach who accessed records of about 150,000 people across 100+ colleges.
42
30
30
30