The FBI’s Internet Crime Complaint Center has issued a public warning about a phishing technique that keeps working even after a victim changes a compromised password. The bureau says malicious actors have been exploiting OAuth, the authorization system that lets apps connect to accounts like Google or Microsoft 365 without ever seeing the underlying password, to plant persistent access that a password reset alone cannot remove.
A Public Service Announcement About Consent, Not Passwords
The advisory, published as PSA number 260901, describes activity the bureau says has been running since late 2025, targeting prominent individuals along with their family members and personal acquaintances. Unlike traditional credential-phishing schemes, which try to trick a target into typing a username and password into a fake login page, this campaign centers on tricking someone into approving a permissions request, the “allow” prompt that appears when an application asks to connect to an existing account.
That distinction is the reason the FBI frames the threat separately from ordinary phishing. A stolen password can be invalidated the moment a victim notices something wrong. A granted OAuth permission behaves differently, continuing to function as an independent credential until it is specifically revoked, regardless of how many times the account password changes afterward. The advisory places this campaign alongside a broader pattern of social-engineering schemes that have shifted away from harvesting raw credentials toward abusing the legitimate authorization systems built into modern cloud accounts, a shift security researchers have tracked across multiple platforms over the past year.
How OAuth Consent Phishing Works
OAuth is the framework behind familiar “continue with Google” or “sign in with Microsoft” buttons that let one service connect to another without a user handing over a password directly. Instead, the account provider issues a token authorizing the requesting app to perform specific actions, such as reading email or accessing files, on the account holder’s behalf.
According to reporting on the advisory, attackers built malicious applications that mimic legitimate services and register them through the same authorization protocols. A target who clicks through a phishing link is directed not to a fake password page but to a real, legitimate-looking permissions screen belonging to the actual account provider, asking for approval to connect. Because the screen itself is genuine, even a cautious user checking for the correct web address may see nothing obviously wrong before approving it. The malicious application’s name and requested permissions are often the only clues distinguishing the request from a legitimate one, and both can be worded to look unremarkable, which is part of why the bureau is treating public awareness as a primary defense alongside technical safeguards.
Why a Password Reset Does Not Help
Once that approval is granted, the malicious application receives an access token that operates independently of the account password. The FBI’s advisory states plainly that access can only be revoked by invalidating the token through the account’s own application or security settings, not by changing the password. That means a victim who suspects trouble and immediately resets a password, even while also enabling multi-factor authentication, can still leave the malicious app connected and functioning.
The bureau notes that this mechanism is precisely how the technique defeats multi-factor authentication as well as password changes. Because the token was issued through a legitimate authorization flow that already cleared any login and verification steps at the time it was granted, it does not need to pass through a password or a one-time code again to keep working.
The Impersonations Behind the Campaign
The FBI’s advisory describes attackers impersonating government officials, media figures and other public personalities, along with fake event coordinators sending invitations designed to look legitimate. Messages have arrived through direct messages on commercial messaging platforms rather than traditional email, often built around plausible pretexts like a document-sharing request or an invitation from someone the target might reasonably expect to hear from.
Once connected, an attacker holding a valid OAuth token can act with many of the same permissions as the account owner, including reading and sending email and accessing stored files or other sensitive data, all without ever possessing the account’s actual login credentials. That capability makes the technique attractive against people whose email accounts or calendars carry information valuable enough to justify a more elaborate approach than mass-market password phishing, including public officials, journalists and executives whose contact lists offer a launching point for further impersonation.
How to Actually Revoke Access
Because a compromised OAuth grant does not disappear when a password changes, the FBI’s guidance points toward account-level application review rather than password hygiene alone. Major providers, including Google and Microsoft, offer a connected-apps or third-party access page inside account security settings where every application holding a live token can be reviewed and individually revoked.
The bureau’s advisory frames periodic review of those connected-app lists as a meaningful defense on its own, separate from standard password and multi-factor authentication practices, precisely because those standard defenses do not reach a token that was already granted. For accounts belonging to public figures, executives or anyone whose contacts might be targeted through impersonation, the FBI’s warning suggests that checking which applications currently have standing access may matter more than how recently the password was last changed.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
