The FBI is warning about a phishing technique that can give attackers continuing access to online accounts without requiring them to steal passwords or defeat multi-factor authentication.
Known as OAuth consent phishing, the technique abuses the legitimate authorization process used by services such as Google and Microsoft to let third-party applications access parts of a user’s account. The FBI says attackers have been using this approach since late 2025, particularly against prominent individuals, their relatives and personal acquaintances.
Instead of building a conventional fake login page, an attacker first creates a malicious application and registers it with a legitimate OAuth provider. The application can be configured to request extensive permissions, potentially including the ability to read or modify emails and files.
The social engineering stage begins when the attacker contacts a target, sometimes while pretending to be a journalist, academic, or representative of a recognizable organization. The victim receives a link presented as access to an important document or other content.
Following the link can take the user to a genuine authorization page operated by a trusted provider such as Google or Microsoft. This makes the attack more convincing because the victim may recognize the website and see a legitimate authentication process rather than an obvious imitation.
The critical step occurs when the authorization screen asks the user to approve permissions for the application. If the victim accepts the request, the malicious app receives an access token allowing it to interact with the account according to the permissions granted.
Depending on those permissions, attackers may be able to access sensitive information, read files or emails, and potentially send messages through the compromised account. They can obtain this access without learning the victim’s password.
The persistence of OAuth permissions makes the technique particularly concerning. Resetting a compromised account’s password does not necessarily remove access already granted to an authorized application. Multi-factor authentication also does not solve the problem when the account owner personally approves the malicious application.
To completely remove the unauthorized access, the application’s permissions and associated access token must be revoked through the account’s security settings.
The FBI recommends treating unexpected links and authorization requests with caution, especially when they arrive from unfamiliar phone numbers, accounts, or contacts. Users should independently confirm the identity of someone sending an unexpected document and carefully examine the permissions an application requests before approving them.
The campaign demonstrates how attackers can exploit legitimate security and authorization features rather than directly attacking them. A familiar Google or Microsoft permission page does not automatically mean the application requesting access is trustworthy.
Users who believe they may have approved a suspicious application should review the third-party applications connected to their account and revoke access for anything they do not recognize or no longer use.