The FBI issued a public service announcement on September 1 describing an attack with an unusual property: nothing is stolen. You are not lured onto a convincing fake login page. You land on a real one, hosted by Microsoft or Google, and you approve a permission request that looks like every other permission request you have ever clicked through.
After that, somebody else can read your mail and send mail as you. Changing your password does not remove them. Turning on two factor authentication does not remove them either, because they never needed to get past it.
The alert is numbered I-090126-PSA. The technique is called OAuth consent phishing, and according to the Bureau it has been running since late 2025 against “prominent victims, their family members, and personal acquaintances.”
The short version
- What it is: attackers register a real application with a real OAuth provider, then talk you into granting it access to your account
- What it looks like: a direct message from a journalist, an event organizer, or a government official, pointing at a document you need to review or an identity check you need to complete
- Where the trick happens: on a genuine Microsoft or Google consent screen. The page is not fake. The app asking for permission is the problem
- Why it beats MFA: your password and your second factor are used correctly, by you, to authorize the attacker’s app. Nothing is bypassed because nothing is attacked
- Why a password reset fails: access is carried by a token issued to the app, not by your credentials. The FBI is explicit that it “can only be revoked by the victim invalidating the token in their application security settings”
- Who is being targeted: public figures and, notably, the people around them. Family and personal contacts are named in the alert
What actually happens when you click
OAuth is the plumbing behind every “Sign in with Google” button and every calendar tool that asks to see your schedule. It exists so that an app can act on your behalf without you handing over your password. That is a genuinely good design, and it is the reason this attack works so cleanly.
The attacker registers an application with a legitimate provider and gives it a name that sounds like infrastructure. Something in the shape of a document viewer, a personal storage service, or an identity verification step. Then they make contact, usually through a commercial messaging app rather than email, because a direct message from a name you recognize carries more weight than anything in an inbox.
The FBI describes the current wave as “impersonating government officials, media, and other publicly known personalities” and asking the target to open a link “under the guise of a file sharing service.” An earlier round impersonated event coordinators sending invitations that required the recipient to verify their identity first.
The link goes to the provider’s own domain. You sign in normally, with your password and your second factor, because that is what the page asks for and there is nothing wrong with the page. Then a consent screen appears listing what the app wants. Read your mail. Send mail on your behalf. See your files.
You click Allow. The provider does exactly what it was built to do and issues the application a token. From that moment the attacker operates as you, and your credentials were never involved in the theft, because there was no theft.
| Classic phishing | OAuth consent phishing | |
|---|---|---|
| The page you land on | A forgery. Wrong domain, wrong certificate, something to spot | The real thing. Correct domain, valid certificate, nothing to spot |
| What you give away | Your password, sometimes a one time code | Permission. Your password never leaves the provider |
| Effect of MFA | Usually blocks it, unless the code is relayed in real time | None. You complete MFA yourself, correctly |
| Effect of a password reset | Locks the attacker out | Nothing. The token is independent of the password |
| How long access lasts | Until you notice and change credentials | Until somebody revokes the app in account settings |
The password is not the lock anymore
This is the part worth internalizing, because it keeps showing up in different clothes.
Most people carry a mental model in which the password is the door and everything else is behind it. Change the password, and whoever was inside is now outside. That model has been wrong for years, and consent phishing is the cleanest illustration of why.
A modern account does not have one door. It has a password, a set of active sessions, a list of app authorizations, sometimes app specific credentials, and recovery paths. Each of those is a separate way in, and resetting one does not touch the others. We saw the same principle at work when attackers started draining paid AI subscriptions using stolen session cookies rather than passwords, and again in the browser ecosystem, where extensions that were clean at install time turned malicious in a later update while keeping every permission the user had already granted.
This is an old trick pointed at better targets
Anyone who was online in May 2017 has seen this before. A message arrived saying a contact had shared a Google Doc with you. The link went to Google, the consent screen was Google’s, and the app requesting permission was simply named “Google Docs.” It was not. Approving it granted the ability to read, send and delete mail, and to reach the victim’s contacts, which is how it turned into a worm and spread to something on the order of a million accounts inside an hour. Google killed the app’s token and the incident ended almost as fast as it started.
What changed since then is aim rather than method. The 2017 event was indiscriminate and loud. The campaign the FBI is describing is quiet and selective, and it goes after people adjacent to the actual target. If a public figure’s mail is hard to reach, their sibling’s is not, and a message from that sibling’s real account is worth a great deal to whoever wants it.
The Bureau has not attributed the campaign or named victims. It says the activity has been observed since late 2025 and is ongoing.
What to actually check, right now
The useful part of this story takes about four minutes and is worth doing whether or not you think you were targeted, because most people have never once looked at this list.
Audit your connected apps
- Google: open your Google Account, go to Security, and find your connections to third party apps and services. Anything you do not recognize, or no longer use, should be removed. Pay attention to entries holding Gmail access
- Microsoft personal accounts: in your account privacy settings, look for the apps and services you have given access to, and revoke what does not belong
- Microsoft work or school accounts: check My Applications, and tell your IT team if something unfamiliar is listed. Administrators can see consent grants across the whole tenant
- Read the scope, not the name. An app called “Secure Document Viewer” that requests permission to send mail as you is not a document viewer
- Sign out of all sessions after removing anything suspicious, then change the password. In that order, not the reverse
- Check the mailbox rules too. Attackers with mail access commonly add a forwarding rule or a filter that auto archives their own messages, and that rule survives everything else you clean up
The FBI’s own advice is shorter and aimed at prevention: treat messages from unfamiliar numbers and accounts with suspicion, verify a sender’s identity through a channel you already trust rather than replying in the same thread, and grant authorization only to applications you know. Victims are asked to keep screenshots and report to a local field office or to ic3.gov.
The honest read
There is a pattern in the security advice most people have absorbed, and it is starting to age badly. Use a strong password. Turn on two factor. If something goes wrong, change the password. Two of those three still hold. The third has quietly stopped being a reset button.
Persistent access now lives in places the average person has never opened: a token list, a session list, an app authorization page buried three clicks into account settings. When something goes wrong, the instinct is to change the password, feel relief, and stop. The FBI’s alert exists largely to interrupt that instinct.
It is the same structural problem the Bureau ran into when it told the public to reboot their routers and the reboot only cleared half of what was there. The remedy people reach for is the one they already know, and it addresses the part of the system the attacker stopped caring about a while ago.
Go look at your connected apps. It takes four minutes, most of you will find something from 2019 that you forgot existed, and the exercise is worth doing before there is a reason to.
