The Federal Bureau of Investigation has warned about ongoing OAuth consent phishing activity in which malicious cyber actors seek persistent access to targeted individuals’ accounts without obtaining their usernames or passwords.
FBI Reports Targeted OAuth Phishing Activity
The FBI has become aware of OAuth consent phishing activity beginning late 2025 involving targeted attacks against prominent individuals, the members of their family, and personal acquaintances. The phishing technique uses impersonation and attempts to persuade a targeted individual to authorize access to an account. The OAuth authorization framework is used commonly to allow websites and online applications to request access to a user’s account on another application without knowing the user’s login credentials.
How the Attack Happens
The report states that an attacker creates a malicious application and registers it with a legitimate OAuth provider. The application can be configured with permissions that allow access to contacts, email, and other account functions. Then, the attacker sends email or text to the targeted individual and attempts to persuade the individual to begin the consent process.
The campaign described by the FBI typically involves impersonation of publicly known personalities, government officials, journalists, and other high-profile individuals through a commercial messaging application. A targeted individual may receive an invitation to participate in an event and be instructed to verify their identity through an application that appears legitimate.
If the targeted individual responds, the attacker can direct the individual to a legitimate permission request screen, including a screen associated with Microsoft 365, Google, or another legitimate cloud service. If the individual approves the request, the individual provides consent through the legitimate cloud service. That authorization can give the malicious application the permissions requested by the attacker. Hence, an attacker can perform malicious activities and access sensitive data without knowing the victim’s password. Multifactor authentication controls are also bypassed.
Password Changes Do Not Cancel OAuth Access
The victim is likely not aware about the phishing attempt and so takes no action. Changing the account password after giving OAuth access does not cancel the OAuth authentication token. The token remains valid and provides the attacker access to the victim’s accounts. To revoke the permissions granted to the malicious applications, the victim needs to remove the application manually in the security settings.
FBI Advises Verification Before Authorization
The FBI advises users to exercise caution with communications from unknown telephone numbers, accounts, or senders who are not in their contact lists. Before responding to an unsolicited communication, users should verify the sender’s identity. The FBI recommends that users authorize only applications they trust and assess the permission request by an application before allowing access.
There is no mention in the report about any healthcare organizations, HIPAA Covered Entities, Business Associates, or regulated healthcare staff affected by the OAuth phishing attacks. To date, the attacks have not resulted in a HIPAA violation or a reportable breach under the HIPAA Breach Notification Rule.