Loading story…
The FBI warned of an ongoing targeted OAuth consent-phishing campaign in which attackers impersonate government officials, media figures, public personalities, event organizers, and other trusted contacts through phishing emails and commercial messaging applications. The activity, observed since late 2025, targets prominent individuals as well as their relatives and acquaintances, luring them into authorizing attacker-controlled applications.
Granting consent gives attackers persistent, high-level access to cloud accounts, including email and sensitive data, through legitimate OAuth authorization flows rather than stolen passwords. The access can survive password changes and bypass conventional password and multifactor authentication protections until the victim explicitly revokes the malicious application's permissions in account security settings. The FBI advised users to verify unsolicited contacts, authorize only trusted applications, and closely review requested OAuth permissions.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The FBI issued a warning about the ongoing campaign, in which phishing emails or commercial messaging-app messages lure targets into approving attacker-controlled applications. The resulting OAuth tokens can provide persistent access to email and sensitive cloud data without obtaining passwords or directly defeating MFA.
The FBI observed malicious actors conducting targeted OAuth consent-phishing attacks against prominent individuals, their relatives, and acquaintances since late 2025. The actors impersonated trusted public figures and used malicious OAuth applications to obtain authorized cloud-account access.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI’s Internet Crime Complaint Center warned that an ongoing OAuth consent-phishing campaign has targeted prominent individuals, their relatives, and personal contacts since late 2025. Attackers impersonate government officials, journalists, public figures, event coordinators, and other trusted contacts through a commercial messaging application, directing targets to authorize malicious applications posing as file-sharing, cloud-storage, or identity-verification services. Victims authenticate on legitimate Microsoft or Google pages, but approving the requested OAuth permissions grants attackers persistent token-based access to email, files, and other sensitive cloud data without stealing passwords. This access can bypass password-based protections and MFA and remains active after a password reset; affected users must revoke the malicious application authorization or invalidate its token in account security settings. The FBI advised independently verifying unexpected messages and authorizing only trusted applications.
Sep 8, 2026
Microsoft warned that **consent phishing** campaigns are increasingly abusing the OAuth authorization flow in Microsoft 365 to trick users into granting attacker-controlled applications access to corporate cloud data. In campaigns observed against remote workers, attackers sent phishing emails through compromised domains or cloud providers, then redirected victims to malicious Office 365 OAuth apps disguised as legitimate services. One campaign impersonated Mexico’s tax administration service to target Spanish-speaking users, while another used financial-themed lures aimed at investment teams; Microsoft later described similar tactics using a **"Review Doc(s) & Sign"** lure tied to a fake business services brand. If a user approved the requested permissions, the attackers could obtain **access and refresh tokens** and use them to access email, files, contacts, SharePoint resources, OneDrive for Business data, and mailbox forwarding settings without directly stealing passwords. Microsoft said it had taken down malicious infrastructure and disabled rogue OAuth apps, while urging organizations to tighten Microsoft identity platform consent settings, limit user consent to **verified publishers** and low-risk permissions, audit application grants, and use Microsoft Defender for Office 365 and related tooling to detect and remediate **illicit consent grants**.
Aug 14, 2026
A new phishing technique called **ConsentFix** has emerged, targeting Microsoft Entra ID by abusing legitimate OAuth 2.0 authorization flows. Attackers craft malicious login URLs and use social engineering tactics—such as fake CAPTCHAs or error messages—to trick users into providing OAuth authorization codes. These codes are then exchanged for access and refresh tokens, granting attackers programmatic access to Microsoft accounts and cloud resources, all without stealing credentials or triggering multi-factor authentication (MFA) prompts. The attack is an evolution of previous consent phishing and ClickFix-style methods, with recent variants making the process even easier for victims through drag-and-drop functionality. ConsentFix is particularly dangerous because it bypasses Conditional Access policies and device compliance requirements, undermining otherwise robust security frameworks. Detection and response require visibility into identity, SaaS, and cloud activity, as traditional prevention mechanisms are ineffective. Security teams are advised to monitor Azure sign-in logs for unusual authentication events and to educate users about the risks of interacting with suspicious login flows or error messages that request manual actions like copying and pasting URLs. The attack highlights the ongoing evolution of phishing tactics targeting cloud authentication systems and the need for advanced monitoring and user awareness.
Jun 29, 2026