The Federal Bureau of Investigation has issued a public warning regarding an ongoing and sophisticated social engineering campaign that targets high-profile individuals, their family members, and acquaintances. The campaign, which the FBI has been tracking since late 2025, aims to gain long-term access to victims' accounts on commercial messaging applications and cloud services.
Attackers are employing OAuth consent phishing, a technique that allows them to bypass traditional password and multi-factor authentication protections. They achieve this by tricking victims into granting a malicious application persistent access to their accounts, often under the guise of reviewing a draft article or document. Once this permission is granted, the attackers gain full visibility into the victim's configured permissions, enabling them to access sensitive data such as emails and files.
The FBI noted that the malicious links used in these attacks provide persistent access to a targeted victim's account. This access can only be revoked by the victim invalidating the token in their application security settings, not by simply changing their password. The attackers register malicious applications through legitimate authorization protocols and then use social engineering tactics to lure victims.
Initially, threat actors impersonated event coordinators and planners, using invitations and identity verification requests as lures. More recently, they have shifted to impersonating government officials, journalists, and publicly known personalities. The FBI did not disclose the specific objectives or origins of the attackers, nor did it provide details on the number of victims or those who have already been compromised.
OAuth is a widely adopted protocol for authorizing access to applications and services, utilizing tokens to establish and maintain authorized access. The FBI emphasized that consent phishing is particularly dangerous because it circumvents common security measures.
To mitigate the risk, the FBI advises individuals to carefully scrutinize communications from unfamiliar phone numbers or accounts. They recommend independently verifying the identity of the sender and only granting access to applications that are explicitly trusted.
