The FBI’s Internet Crime Complaint Center says a technique called OAuth consent phishing is giving criminals lasting access to victims’ email, cloud files and contacts without ever stealing a password. In a public service announcement dated September 1, 2026, the bureau describes attackers who skip the password entirely and instead trick a target into approving a permissions screen for a malicious app, one that then keeps working long after the target has changed every credential they own. IC3 says it has tracked the activity since late 2025.
What makes the method notable is not the phishing lure itself but what it asks a victim to hand over.
A real login screen, then one extra click
Most phishing warnings tell people to watch for a fake login page. This one does not, because the login page in an OAuth consent attack is usually real. IC3 describes a flow in which a target clicks a link, lands on Microsoft’s or Google’s actual authentication page, signs in normally, and is then shown a second screen asking whether to grant a named app permission to read email, files or contacts. “If they click ‘Allow,'” the advisory warns, “the actor will have full visibility to configured permissions,” at which point the malicious app, not the attacker’s own login credentials, becomes the thing doing the accessing.
IC3 calls the overall approach “a deceptive, sophisticated approach to access user accounts without requiring a password” in the advisory’s own language, and the lures dressing up that one click vary: the bureau and outside researchers have both documented attackers posing as journalists requesting comment, academics requesting a document review, or event organizers sending a calendar invite, all designed to make approving an unfamiliar app feel routine rather than risky.
Why a password reset does not close the door
Conventional account-compromise advice collapses here. Resetting a password, enabling multi-factor authentication after the fact, even generating a brand-new set of recovery codes, none of it touches the connection once an app has been approved. IC3 describes the result as “persistent API access to the user’s data without needing a password or MFA,” a technical way of saying the malicious app authenticates itself directly to Microsoft’s or Google’s servers using its own token, independent of whatever the human account holder’s password happens to be at any given moment.
Microsoft’s own guidance on this attack class, published years before this specific campaign, describes exactly the same structural problem: once an adversary’s application has consent, it “operates outside normal account security controls,” and traditional remediation steps such as password resets or stricter multi-factor enforcement are, in Microsoft’s words, ineffective against it. The only way to sever the connection is to revoke the app’s access directly, not to change anything about how the human logs in.
Organizations running Microsoft 365 have one lever individual account holders do not: an administrator can disable tenant-wide app consent entirely, so that no employee can approve a new third-party app without a security team signing off first. That setting closes the exact hole IC3’s advisory describes, but only inside a managed workplace account. The personal Microsoft and Google accounts the bureau says this campaign is actually targeting have no equivalent administrator layer sitting above them, which is part of why the advisory frames this as a threat to individuals rather than to corporate IT departments.
Who the campaign has targeted since late 2025
This is not a mass, indiscriminate spam run. Reporting on the advisory describes IC3’s targeting pattern as concentrated on “personal accounts of high-profile individuals, their family members, and personal acquaintances,” reached through commercial messaging apps and email rather than the account holder’s own employer-managed inbox, which typically carries more automated OAuth-app screening. The bureau has declined to disclose specific victim counts or attribute the campaign to a named group, saying only that the activity spans the country rather than concentrating in one region or industry.
Checking which apps already have access
Both companies whose sign-in flow the technique abuses already publish a way to audit it. Microsoft directs users to a linked-apps management view reachable through its self-service application portal, where every app currently holding a token can be reviewed and individually revoked. Google’s equivalent process, laid out on its own account help page, advises granting access only to trusted third-party apps in the first place, and lets an account holder pull up every connected app and cut its access from the same linked-apps screen.
Neither company can force that review to happen; it depends on someone thinking to look. IC3’s advisory ends with the same instruction: scrutinize messages from unfamiliar contacts before clicking through, verify a sender’s identity independently rather than trusting the request itself, and check the permissions list, not just the password field, when something about an account feels off.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Supplements now rank as the fifth-leading cause of death from liver disease.
- Herbal supplements are landing Americans in the hospital with liver damage, doctors warn
- General Motors is switching on cameras that record inside your vehicle by update
- A geomagnetic storm is forecast to hit Earth today, pushing the northern lights unusually far south
