FBI Warns of OAuth Consent Phishing Targeting Prominent Individuals
Summary
The FBI says attackers have used OAuth consent phishing since late 2025 to gain persistent access to prominent individuals’ accounts. Malicious apps can access emails and files; changing a password does not revoke access.
Key points
- The FBI says the activity has been ongoing since late 2025 and targets prominent individuals, relatives, and personal contacts.
- Attackers reportedly impersonate people such as journalists or event organizers through messaging apps or email, then lure targets to authorize an app under the pretext of reviewing a file or confirming identity.
- The malicious app is registered with a legitimate OAuth provider, and the victim is taken to the provider’s genuine login page before being asked to grant permissions.
- After authorization, the app can access account data within the granted permissions, including reading and sending emails and accessing files, without the attacker needing the password.
- The FBI warns that changing a password does not remove the app’s access; victims must revoke its token through application security settings.
- The FBI recommends independently verifying unfamiliar senders and authorizing only trusted applications. It has not identified the attackers or victims.
Article Details
- Event Type
- FBI warning about ongoing OAuth consent phishing targeting prominent individuals and their contacts
- Impact
- Attackers can gain persistent access to victims' accounts, including private emails and files, after victims approve malicious applications. The access can bypass passwords and multi-factor authentication, and changing a password does not revoke it; the application token must be invalidated through account security settings.