The FBI warns of an ongoing social-engineering campaign targeting high-profile individuals and their contacts through a commercial messaging app. Attackers impersonate trusted people (e.g., government officials, journalists) and send links that trick victims into approving OAuth access to a “malicious application,” giving long-term access to email/files without needing the password, even bypassing MFA.
The FBI has issued a warning about an ongoing social engineering campaign that uses OAuth consent phishing to gain long-term access to victims' accounts. Instead of stealing a password directly, attackers send a link, often on a commercial messaging application, that leads to a legitimate-looking authorization screen for a cloud service such as Microsoft or Google. If the victim approves the request, they unknowingly grant a malicious application persistent access to their account data.
The campaign has used at least two documented lures. In one, attackers impersonate a journalist or government official and ask the target to review a draft article or document, with the review link triggering the consent prompt. In another, attackers pose as event coordinators or planners, sending invitations or identity verification requests that funnel the victim into the same type of authorization flow.
OAuth consent phishing is effective because it does not rely on stealing credentials at all. The attacker registers an application through a legitimate authorization protocol, then uses social engineering to convince the victim to click "allow." Because the access is granted through a token rather than a password, standard defenses like password resets and multi-factor authentication do not remove it. The FBI specifically notes this approach can bypass both passwords and MFA, which is what makes it especially dangerous for high-profile targets and their networks of contacts.
According to the FBI, attackers are targeting prominent, high-profile people, their family members and acquaintances. Impersonated identities include government officials, journalists and other publicly known personalities. This puts executive leadership, public affairs and government affairs staff, executive assistants, and anyone managing Microsoft or Google cloud accounts at elevated risk, since these roles are more likely to receive unsolicited requests to review documents or confirm event attendance.
Defenders and high-profile individuals should watch for:
To build resistance, the FBI recommends independently verifying the identity of the sender through a separate, trusted channel before clicking any link. Anyone who has already granted a suspicious app permission should not rely on a password change alone. Instead, they need to revoke access directly by invalidating the token in their account's application security settings, since that is the only way to fully remove a malicious application's access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is an attack where victims are tricked into approving app permissions on a legitimate cloud service like Microsoft or Google, giving attackers persistent access via a token rather than a stolen password.
No. Once permission is granted, it can only be revoked by the victim invalidating the token in their application security settings, not by changing the password.
Not necessarily. The FBI warns that consent phishing can bypass both passwords and multi-factor authentication because it relies on legitimate authorization protocols rather than credential theft.
The FBI says attackers are targeting prominent, high-profile people, their family members and acquaintances, often through a commercial messaging application.
You get a Telegram message from a “journalist” asking, “Can you review this draft article? Just open the link.” Looks legit, right? You tap the link and a real Microsoft or Google page pops up, asking you to ALLOW a cloud app to read your email and files. That’s OAuth consent phishing, the FBI says it can bypass both your password and MFA. Here’s the trap: even if you change your password later, those tokens give that malicious app long-term access to your inbox and documents. The FBI says attackers are doing this to high‑profile people, their families, and contacts. Aha moment: that “Allow” click is more powerful than your password. If any Telegram invite or draft link leads to an OAuth consent screen, stop and verify the person through a separate, trusted channel before you touch Allow.
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A financially motivated actor (“Doubloon Dredger”) abused legitimate Notion sharing notifications to trick employees into opening a PDF and completing a Microsoft device-code login flow. This allowed the attacker to harvest authentication tokens and access victim accounts without needing the…
This report describes real-world social engineering where victims are tricked into copying and pasting commands that install malware on macOS and Windows. It also highlights device code phishing activity targeting Microsoft Entra ID/Microsoft 365 tokens, enabling attackers to access accounts and…
