FBI Warns of OAuth Consent Phishing Targeting Prominent Individuals

The FBI has issued a warning about OAuth consent phishing attacks that have been targeting prominent individuals, their families, and personal contacts since late 2025. This sophisticated attack method allows cybercriminals to gain unauthorized access to user accounts without needing passwords. By sending deceptive messages that lead victims to approve access to malicious applications, attackers can read emails, access files, and maintain persistent access. The attacks impersonate trusted figures like government officials and journalists, making it difficult for victims to recognize the threat. Once permission is granted, the attacker can act on behalf of the victim without needing their credentials. Victims are advised to scrutinize communications from unknown sources and verify the identity of senders before granting access. The FBI has not disclosed specific attackers or victims involved in these campaigns.

Key Points: • OAuth consent phishing allows attackers to bypass password requirements. • Victims unknowingly grant access to malicious applications through deceptive messages. • The FBI advises increased scrutiny of unfamiliar communications to prevent attacks.