The FBI’s Internet Crime Complaint Center warned on Sept. 1, 2026, in public service announcement PSA260901, that attackers are reaching email accounts without ever learning a password. The method is called OAuth consent phishing, and the access it produces survives a password reset. A victim who has already granted the permission can change credentials as many times as desired and the intruder remains inside the mailbox.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The announcement gives no complaint count and no loss figure. What it supplies is a mechanism, and the mechanism explains why the usual advice for a compromised account, reset the password, fails in this case. The attacker never holds the password in the first place, so there is nothing to reset on the attacker’s side of the arrangement.
How the FBI says the approval is obtained
According to the IC3 announcement, the victim is sent a link and lands on a genuine login page run by a provider such as Microsoft or Google. The sign-in is real, and the credentials typed in go to the real provider, not to the attacker. Then a permission screen appears, asking the account holder to authorize an app that the attacker registered. The FBI calls the technique “a deceptive, sophisticated approach to access user accounts without requiring a password.”
The decision that matters is a single click. As the announcement puts it, if the victim clicks “Allow,” the attacker can act on the victim’s behalf without a password or multi-factor authentication. That is the reason the usual defenses do not apply. Multi-factor prompts guard the act of signing in, and the signing-in has already been done honestly by the victim; the approval that follows is a different transaction.
Why a token outlasts a password change
The distinction comes from the standard behind the permission screen. In RFC 6749, the OAuth 2.0 framework, an access token is “a string representing an authorization issued to the client,” and the person who owns the data is the resource owner, the one “capable of granting access.” The grant is a credential of its own. It is handed to the app, not derived from the password each time, and the same document describes refresh tokens as “credentials used to obtain access tokens,” which a provider may issue at its discretion.
How a given provider treats existing grants after a password change is that provider’s policy. The FBI’s statement for this campaign is unambiguous: the access persists, and it can only be revoked by the victim invalidating the token in their application security settings.
A password reset therefore addresses the wrong credential. It closes the door that the attacker never used and leaves open the one that the victim unlocked. Because the app was granted permissions such as reading and sending email and reaching stored files, the intruder works from inside the account, acting within whatever permissions the victim approved.
Who is targeted and what the lures look like
The announcement says the activity has run since late 2025 and is aimed at prominent people, their family members and personal contacts. Messages arrive through personal accounts, often on a commercial messaging application, from someone posing as a journalist, an academic, a government official or an event planner. Help Net Security’s summary of the announcement adds that the FBI has not said who is behind the campaign or who the victims are.
The lures are mundane by design. The announcement lists a file-sharing request, a draft article or document to review, and an event invitation that requires identity verification through an app. KnowBe4’s reading of the same notice notes that earlier waves posed as event coordinators, while the newest ones impersonate officials and media figures on messaging apps and ask the target to open what looks like a file-sharing link. Each one gives the recipient a believable reason to follow a link to a real login page, which is where the trap closes. An unfamiliar phone number or account, or a sender missing from the recipient’s known contacts, is the warning sign that the announcement describes.
Revoking access and reporting it
The FBI’s advice has three parts. Treat messages from unfamiliar contacts with skepticism, confirm the sender through a separate channel, and grant authorization only to trusted applications. If an account is already compromised, the malicious app has to be removed in the account’s security settings, because a password change alone does not revoke the token.
On Google accounts, Google’s support page on third-party access says account holders can remove an app’s access at any time, and that once revoked the developer can no longer reach data through the account. The same page cautions that an app may keep data it has already copied. Google’s page points account holders to a linked-apps list at myaccount.google.com/linkedapps, where each connected app is shown with the level of access it holds, so a stranger’s app with broad permissions is the entry to remove. Victims are asked to report to a local FBI field office or to IC3 at ic3.gov, and to keep screenshots of the messages and a record of the information the attacker requested.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
