The FBI’s September 1, 2026 public service announcement (alert number I-090126-PSA) warns about OAuth consent phishing. Since late 2025, actors have used it against prominent individuals, their family members, and personal acquaintances. If the target approves the request, the actor gets persistent access to the account, and changing the password does not remove it.
What it is
OAuth consent phishing does not steal a password. The actor sends a direct message or email with a link, and the link leads to a legitimate communication provider’s permission request screen. The target is asked to approve access for an application the actor controls. Actors register their malicious applications through legitimate authorization protocols.
Once the target approves, the application has access to the account without needing the password. The FBI says this technique can bypass multi-factor authentication after consent is granted, and that only revoking the token in the account’s application security settings removes the access. Changing the password does not.
What the lures look like
Recent activity has used a commercial messaging application. The senders impersonate government officials, media, and other public personalities, and ask the target to open a link presented as a file-sharing service. Earlier activity impersonated event coordinators and asked the target to verify their identity through a malicious application.
Who is affected
The FBI describes the targets as prominent individuals, their family members, and personal acquaintances. If a personal account of yours holds work mail or files, we recommend reviewing its consents too. That is our recommendation, not an FBI finding.
What to do
- Treat messages from unfamiliar phone numbers or accounts outside a known contact list with scrutiny.
- Verify the sender independently, through a channel other than the message itself, before opening a link that asks for access.
- Grant authorization only to applications you trust.
- Open the application security settings of each account and look for applications you do not recognize. Revoke their access. A password change does not do this, and multi-factor authentication does not stop this attack once consent has been approved.
- Keep screenshots of the messages and note any information the sender asked for.
- Contact your relevant security officials and report to your local FBI Field Office or to the Internet Crime Complaint Center at ic3.gov.
Where to report
The Internet Crime Complaint Center describes itself as the central hub for reporting cyber-enabled crime. Its complaint form is reached from the File A Complaint option on ic3.gov.
When to get help
If an application you did not approve has access to a business account, or you are unsure which connected applications are legitimate, our cybersecurity team can review them with you. Contact Summit Networks to get started.