The FBI’s Internet Crime Complaint Center warned this week that cyber criminals are hijacking accounts belonging to prominent individuals, their family members and personal acquaintances using a technique that defeats both passwords and multi-factor authentication without ever stealing either: OAuth consent phishing.
According to the IC3 alert, attackers directly message targets on commercial messaging platforms while impersonating government officials, media figures or event coordinators, then push a link framed as a file-sharing or identity-verification request. The link routes the victim to a genuine login screen from a real provider, so the victim authenticates normally. What follows is a permission prompt asking the victim to authorize a malicious application, and approving it hands the attacker a persistent access token rather than a password. The IC3 alert is explicit about why that distinction matters for response: once permission is granted, it “can only be revoked by the victim invalidating the token in their application security settings; not by changing the password.”
The original insight for security teams is what this technique quietly routes around. Enterprise identity programs have spent years hardening the password-and-MFA layer, and OAuth consent phishing does not attack that layer at all. It attacks the authorization layer sitting behind it, where a user’s one-time click grants an application standing access that no password rotation, and often no MFA re-challenge, will revoke. Security teams that treat “no credentials were entered” as evidence an account is safe are applying the wrong test to this attack.
Defenders should extend phishing-awareness training beyond credential-harvesting pages to include OAuth consent screens, particularly for executives and public-facing staff who are the named target profile here, and should audit third-party application permissions in Microsoft 365 and Google Workspace admin consoles on a recurring basis rather than only after an incident. That audit trail matters more as identity infrastructure increasingly runs on systems defenders cannot fully see into, and it pairs with existing guidance that authentication-adjacent flaws keep surfacing in the platforms enterprises trust by default.
