FBI Warns of OAuth Consent Phishing Targeting High-Profile People
Summary
The FBI warns that attackers are using OAuth consent phishing through a commercial messaging app to gain persistent access to high-profile targets’ Microsoft or Google accounts, bypassing passwords and multi-factor authentication.
Key points
- The FBI says it has tracked the campaign since late 2025; it targets prominent people, their families, and acquaintances.
- Attackers reportedly impersonate government officials, journalists, and public figures, using document or draft-review lures.
- Victims are tricked into approving malicious applications that access Microsoft or Google accounts.
- Granted OAuth access can expose emails, files, and other data, and may persist even after a password change.
- The FBI says victims must revoke the application’s token in their security settings to end its access.
- The FBI advises verifying senders independently and granting access only to trusted applications; it did not specify victim numbers or attacker objectives.
Article Details
- Event Type
- OAuth consent phishing campaign targeting prominent people and their close contacts through a commercial messaging app.
- Impact
- Victims who approve the malicious app can give attackers persistent access to emails, files, and other sensitive account data. The access can bypass passwords and multi-factor authentication and may remain until the victim revokes the token; the FBI did not disclose the number of victims or the attackers’ objectives or origins.