Attackers are targeting prominent individuals, their relatives and personal contacts to gain persistent access to their accounts, including private emails and files, the FBI has warned.
The FBI’s Internet Crime Complaint Center (IC3) says the activity, which uses a technique called “OAuth consent phishing,” has been ongoing since late 2025. The FBI describes it as “a deceptive, sophisticated approach to access user accounts without requiring a password.”
OAuth is a framework that lets one application request access to a user’s account on another service without the user handing over login credentials directly.
“Recently observed activity includes impersonating government officials, media, and other publicly known personalities on a commercial messaging application (CMA) and soliciting the targeted individual to access a malicious link under the guise of a file sharing service through an application under the malicious actor’s control,” the FBI wrote in its advisory.
According to authorities, attackers register a malicious application with a legitimate OAuth provider and may name it to resemble a “third-party personal storage or identity verification service.”
They then contact targets through a commercial messaging app or email, posing as a journalist, academic, or event organizer, asking the target to review a document or confirm their identity through the application.
The link takes the victim to a genuine login page belonging to the service provider, such as Microsoft or Google.
Once the victim approves the permission request, the attacker’s application gains access to the account within the permissions granted. From that point, the attacker can act as the victim, reading and sending emails and accessing sensitive data, without ever needing the victim’s password.
The FBI notes that a password change does not revoke this access. The victim must invalidate the token through their application security settings.
“By registering malicious applications through legitimate authorization protocols and using social engineering tactics, cyber actors can bypass both passwords and multi-factor authentication, which makes consent phishing especially dangerous,” the FBI warns.
The FBI advises increased scrutiny of messages from unfamiliar phone numbers or accounts and recommends independently verifying a sender’s identity. It also advises granting authorization only to trusted applications.
The FBI has not disclosed who is behind the attacks or who the victims are.
