The FBI just issued a public warning about an attack that doesn’t need your password, doesn’t trigger most security alerts, and can persist on your account long after you think you’ve locked things down. That’s not a hypothetical threat. It’s happening now, and the fix is not obvious.
As reported by Android Headlines, the FBI’s Internet Crime Complaint Center issued a public service announcement warning Americans about a surge in OAuth consent phishing attacks targeting Google and Microsoft accounts. The technique works by tricking users into clicking what looks like a legitimate permission request on a real platform, then granting a malicious app access to their account. No stolen password required.
OAuth, or Open Authorization, is the standard that lets you connect third-party apps to your accounts. When you allow a calendar app to read your Google Calendar, that’s OAuth doing its job. It’s a legitimate, widely used system. But that legitimacy is exactly what attackers are exploiting. They register a malicious app with Google or Microsoft, send victims a message pretending to be an official, a journalist, or some other credible contact, and include a link to what appears to be a document. That link redirects to a real Google or Microsoft permission screen. The user sees a familiar, trustworthy interface. One click to approve, and the attacker gets an access token with full reach into that account.
Once inside, they can read emails, access stored data, and send messages directly from the victim’s account. And here’s the part that catches most people off guard: changing your password does nothing. The attacker’s access token remains valid regardless of a password reset. The only way to cut off their access is to find the authorized app in your account’s security settings and revoke its permissions manually.
The FBI did not name specific targets but described them as “prominent victims” and noted that attackers are also going after family members of those targets. That detail matters. It suggests this isn’t a spray-and-pray phishing campaign. It’s targeted, which makes it harder to detect and more damaging when it lands.
This fits a broader pattern in how account attacks have shifted. Multifactor authentication has made password theft less effective, so attackers are moving to methods that bypass passwords entirely. OAuth phishing sits in that same category as SIM-swapping and session token theft. The attack surface is no longer just your login credentials. It’s every permission you’ve ever approved.
To protect yourself, check your connected apps right now. Here’s where to look:
- Google: myaccount.google.com, then Security, then Third-party apps with account access
- Microsoft: account.microsoft.com, then Privacy, then Apps and services
- Revoke access for any app you don’t recognize or no longer use actively
- Be suspicious of any message that directs you to approve app permissions, even if the platform looks real
The permission screen being genuine doesn’t mean the app behind it is. That’s the core of this attack, and it’s a distinction most users aren’t trained to make.