The FBI warns attackers are impersonating public figures on messaging apps and email to trick targets into approving a malicious OAuth app. Victims are sent links that lead to real Microsoft or Google login/consent screens, where approving access grants attackers ongoing access to emails and files. Because access is token-based, changing a password may not stop the attacker; the victim must revoke the app’s permissions.
The FBI has warned since late 2025 about a technique called OAuth consent phishing. Attackers impersonate government officials, media figures, and other publicly known personalities, contacting targets through commercial messaging apps or email. The pretext is usually simple: review a document or confirm identity through a third-party application. The attacker registers a malicious OAuth application with a legitimate provider and names it to resemble a personal storage or identity verification service.
When the target clicks the link, they land on a genuine login page belonging to Microsoft, Google, or a similar provider. This is not a spoofed page; it is the real authorization screen. If the victim approves the permission request, the attacker's application gains access to the account within the scope granted, often covering email and files.
This attack works because it exploits trust in real infrastructure rather than trying to fake it. Since the consent screen is genuine, many of the usual signs of phishing, such as a suspicious domain or fake login form, are absent. The social engineering layer, impersonating a journalist, official, or event organizer, adds urgency and legitimacy to the request, making the victim less likely to scrutinize the app name or requested permissions closely.
The technique also bypasses traditional defenses. Because access is token-based rather than password-based, standard credential protections like multi-factor authentication do not block it once the token is granted.
Defenders and high-profile individuals should verify a sender's identity independently, through a known phone number or separate channel, before clicking any link or approving an app. Only grant OAuth permissions to applications that are recognized and trusted, and review the scope of access requested before approving anything.
If consent phishing is suspected, a password change alone will not remove the attacker's access. The token or app permission must be revoked directly in the account's security settings. Organizations that support executives, government affairs staff, or communications teams should build this revocation step into their incident response procedures, since these are the audiences most frequently targeted by this technique.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is an attack where victims are tricked into approving a malicious OAuth application on a real Microsoft or Google login page, giving the attacker ongoing access to email and files within the granted permissions.
No. The FBI notes that a password change does not revoke this access; the victim must invalidate the token through their application security settings.
The FBI has observed attackers impersonating government officials, media figures, and other publicly known personalities to target executives, government affairs staff, and people who manage high-profile accounts.
Be suspicious of unexpected requests to review a document or confirm identity through an unfamiliar app, especially from unfamiliar phone numbers or accounts claiming to be a known person.
You get a message from a “journalist” asking you to review a document and confirm your identity through their app. You click, and it jumps to a real Microsoft or Google consent screen. This is OAuth consent phishing: the fake part is the app asking for access, not the login page. Here’s the trap: once you click Allow, that app can keep reading your emails and files by token, even if you change your password or have MFA on. If any ‘document review’ or ‘identity verification’ app feels off, stop and independently contact the person using a known number or channel before you approve anything.
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
The FBI warned that scammers are impersonating IC3 leadership using AI-generated (deepfake) videos and spoofed IC3 websites to trick prior fraud victims into sharing more personal and financial information. In one example, victims are contacted on Facebook Messenger by someone posing as an FBI…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
The FBI says criminals are using social engineering to take over social media accounts, steal explicit content, and sell or post it online along with victims’ personal information. Reported tactics include pretending to be a social media company representative, spamming victims with password-reset…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
