A message arrives on a commercial messaging app from someone claiming to be a journalist, a government official or an event planner. It asks for a quick read of a draft, or for identity verification before an invitation goes through. The link opens a genuine Microsoft or Google sign-in page, the login works as normal, and one click on “Allow” later a stranger holds standing access to the mailbox.
Read next on Morning Overview: A $1 billion gas plant planned for Superior, Wisconsin, has been abandoned
The FBI’s Internet Crime Complaint Center described the technique, called OAuth consent phishing, in a public service announcement dated Sept. 1, 2026. That notice is more than two months old by Nov. 11, and no newer FBI bulletin on the subject turned up in a search, so the guidance below stands as the bureau’s current position rather than breaking news.
The consent screen on a real Google or Microsoft page
OAuth is the framework that lets one service act on a person’s behalf inside another, the same mechanism behind “sign in with Google” buttons and calendar apps that read email. According to the IC3 public service announcement of Sept. 1, the attacker registers a malicious app with a legitimate provider and names it to resemble something trustworthy, such as a personal storage service or an identity-verification tool. The app is granted broad permissions, including reading and writing files and email.
The victim never types a password into a fake site. The credentials go only to the real provider, and the advisory notes they are not handed to the attacker’s app. What changes hands is permission: once the victim approves the request, the actor gets persistent programmatic access to the account data. The FBI states this route can bypass both passwords and multi-factor authentication, because nothing in the login itself was forged.
Lures the FBI documented since late 2025
The bureau says the campaign has run since late 2025 and has gone after prominent individuals, their family members and personal acquaintances. Three lure styles are listed. Actors have posed as government officials, media figures or other public personalities on a commercial messaging application, sending a link framed as a file-sharing service. Others pretended to be event coordinators, offering an invitation that required identity verification through the actor’s app. A third group claimed to be journalists or academics asking a target to review a draft article or document.
The reporting by Help Net Security adds that the FBI has not said who is behind the activity or how many victims there are, and the advisory itself names no individuals. What it does show is a pattern built on borrowed credibility: a familiar-sounding sender, a plausible reason to click, and a permission prompt that looks routine.
A password reset leaves the token alive
The most counterintuitive line in the advisory concerns cleanup. Account holders who suspect a break-in usually change the password first. The FBI says that does not end this kind of access, which it describes as persistent, and that the token “can only be revoked by the victim invalidating the token in their application security settings.”
The reason is structural. The authorization is a separate grant that lives alongside the password, so rotating the password leaves the grant standing. A person could change the password, feel safe, and still have a rogue app reading messages for weeks. For anyone in a sensitive role, such as a reporter with sources or an official with correspondence, that gap is the real hazard the notice is built around.
Removing the app from account security settings
The prescribed fix is blunt. In the FBI’s words, “Immediate removal of the app via the user’s security settings is necessary for remediation.” Google keeps a list of apps connected to an account, and its help page on linked apps explains that access can be removed at any time and that an app flagged as misusing data can be reported from the same place. After removal the app can no longer reach the data, though a developer may still hold copies already collected.
The advisory adds three further steps: contact relevant security officials, record the information the scammer elicited and keep screenshots of the messages, and report the incident to a local FBI field office or through the Internet Crime Complaint Center.
Prevention advice is short. The FBI tells recipients to scrutinize messages from unfamiliar numbers or accounts, to verify a sender through a separate channel before acting, and to grant authorization only to applications that are trusted. A permission screen asking for broad access to mail and files, sent by someone who cannot be confirmed independently, fits the exact profile the bureau laid out in September.
One question the notice leaves open is scale. With no victim count and no attribution published, the public record rests on a single advisory and the bureau’s description of targets as prominent people. Whether ordinary account holders have been hit in volume is not stated anywhere in the FBI’s text.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Zero Motorcycles unveiled an electric motorcycle targeted at under $8K and a street-legal dirt bike at EICMA
- New FCC rules on how people can stop robocalls and texts take effect Nov. 25
- Neanderthals in Spain carved a wooden object that matches nothing archaeologists have ever found
- The FAA wants $2.39 million from a flight school it says flew a Cessna about 280 times with an unapproved part
