FBI warns of OAuth consent phishing campaign targeting prominent individuals

The FBI has issued a public service announcement warning of a deceptive phishing campaign targeting prominent individuals, their family members and acquaintances on a commercial messaging application. The attackers impersonate government officials, journalists and public figures to trick victims into granting access to a legitimate cloud service such as Microsoft or Google, under the guise of reviewing a draft article or document.

The campaign, tracked since late 2025, uses OAuth consent phishing to gain persistent access to victims’ accounts without requiring a password. Once permission is granted, it can only be revoked by invalidating the token in the application’s security settings, not by changing the password. The FBI advises users to scrutinise communications from unfamiliar senders, verify identities independently, and only grant access to trusted applications.