FBI warns of consent phishing aimed at prominent people and their families
The FBI's Internet Crime Complaint Center warned that since late 2025, malicious cyber actors have targeted prominent individuals, their family members, and personal acquaintances using OAuth consent phishing. According to the PSA, actors impersonate government officials, media, and other public figures on messaging apps and send a link presented as a file-sharing service; if the target approves the request on the permission screen that follows, an application controlled by the actor can gain access to account data, including email and files, without obtaining the victim's password or defeating a second factor.
ASSESSMENT
The FBI's flowchart shows the victim signing in on the genuine provider's login page then approving a permission request that gives the actor's application persistent access to whatever it was set up to read, including email and files. A personal inbox is also the recovery path for many other accounts, and the inclusion of acquaintances in the target set suggests an aim beyond fraud.
TAKEAWAYS
Review the third-party apps connected to their your email, calendar, and related sensitive information accounts and remove anything unrecognized
Establish that document links arriving by messaging app from officials, journalists, or public figures are verified through a separate channel before anyone clicks (e.g., call back to a verified number not just a number provided)
Determine who your organization is responsible for monitoring potential exposures like app tokens
