Federal investigators have detailed a phishing technique that keeps working even after a victim does the one thing security teams almost always recommend: changing a compromised password. The approach abuses the consent screens built into everyday sign-in systems, tricking people into approving a malicious application rather than handing over login credentials directly. Because the resulting access lives inside a digital token rather than a password, resetting the account does nothing to stop it.
The technique, known as OAuth consent phishing, has been circulating since late 2025 and continues to show up in active cases. It relies on a framework most internet users interact with constantly without realizing it: the pop-up that asks whether an app can access a calendar, an inbox, or a set of files through a service like Google or Microsoft. That framework, called OAuth, exists so that one application can request limited access to another account without the user ever typing a password into the requesting app. Attackers have learned to weaponize the same convenience.
How Consent Phishing Actually Works
The scheme begins with an attacker building an application and registering it with a legitimate identity provider, often disguising it as something mundane, such as a personal file-storage tool or an identity-verification service. The attacker then configures that application to request broad permissions, including the ability to read and send emails or access stored files. A phishing message, sent through email or a messaging app, invites the target to click a link tied to that application.
When the victim clicks, they land on a real login page belonging to the legitimate provider, not a fake lookalike site, which is part of what makes the scheme effective. The victim enters credentials directly into that authentic page, so the password itself is never exposed to the attacker. Immediately afterward, a consent prompt appears asking whether the newly created application should be granted the permissions the attacker configured. If the victim clicks “allow,” the attacker’s application receives a persistent access token, and from that point forward, the attacker can act inside the account without ever needing the password again.
Who the Scam Has Been Targeting
According to the alert, malicious actors have concentrated on prominent individuals, along with their family members and personal acquaintances, contacting them directly through commercial messaging applications. Some campaigns impersonate government officials, journalists, or other publicly recognizable figures, asking the target to review a shared document or verify their identity through the attacker’s application. Other versions pose as event coordinators or planners, sending an invitation that requires the recipient to confirm attendance through a linked identity check. In both cases, the social engineering is designed to make clicking through feel routine rather than suspicious.
Why Changing the Password Does Not Help
Traditional advice after a suspected account compromise centers on changing the password and, where available, resetting multi-factor authentication. Neither step interrupts this attack. The Internet Crime Complaint Center explains that once permission has been granted, the access token operates independently of the password entirely and remains valid until the victim specifically revokes it inside the application’s own security settings. A user can rotate their password as often as they like while the attacker retains uninterrupted access to email, files, or whatever else the token was scoped to reach. That same independence from the password is also what allows the technique to sidestep multi-factor authentication, since the attacker is not re-authenticating with stolen credentials at all.
Removing the Access Once It Is Granted
Because the vulnerability lives in the list of connected applications rather than in the password itself, remediation requires a different kind of cleanup. Recovering the account means opening the security or permissions settings of the underlying provider, such as a Google or Microsoft account dashboard, and manually revoking access for any application that should not be there. Investigators recommend treating unfamiliar contacts, unexpected file-sharing requests, and unsolicited identity-verification prompts with heightened scrutiny before granting any permissions at all, and independently verifying a sender’s identity through a separate channel rather than trusting the message itself. Anyone who suspects they have already granted access to a malicious application is advised to report the incident to a local FBI field office or through the bureau’s online complaint portal, and to preserve screenshots of the original messages for investigators.
Why This Shift in Tactics Matters
The bureau frames the emergence of consent phishing as a deliberate evolution away from older spear-phishing methods, which typically relied on tricking a target into typing a password into a fake login page or opening a malicious attachment. Those older techniques still work, but they leave a credential-harvesting trail and are increasingly caught by password managers and browser warnings that recognize spoofed login pages. Consent phishing avoids that exposure entirely by routing the victim through a real, unaltered login page belonging to a legitimate provider, which means many of the visual cues people are trained to look for, such as a misspelled domain or an unfamiliar page design, simply are not present. The deception happens one screen later, at the consent prompt, where a request framed as routine document access can carry the same real-world consequences as handing over full control of an inbox.
That design also explains why the bureau is emphasizing prevention over detection. Antivirus software and spam filters are built to catch malicious code or spoofed pages, not a legitimate authorization request that a user approves voluntarily. Once an attacker’s application has been granted permissions, its ongoing activity looks, to most monitoring systems, indistinguishable from a normal third-party integration working as intended. That is part of why the guidance centers on scrutiny before clicking “allow,” rather than on any tool that promises to catch the compromise afterward.
This article was created with the assistance of AI and reviewed by an editor.
More from Morning Overview
- The NSA is again telling phone owners to switch off one location setting
- Four U.S. startups fired up their first small nuclear reactors, aiming to power AI data centers on-site
- 11 engines built to run well past 200,000 miles
- A handful of car transmissions are so tough that mechanics say they almost never die
