What happened
The FBI issued a public service announcement warning that attackers are targeting prominent, high-profile people, their family members and acquaintances on a commercial messaging application to gain long-term access to accounts containing sensitive data. The campaign, which the FBI says it has been tracking since late 2025, involves attackers impersonating government officials, journalists and publicly known personalities.
The method is OAuth consent phishing. Victims are tricked into granting access to a legitimate cloud service, such as Microsoft or Google, under the guise of reviewing a draft article or document. If the user approves the request, the malicious application gains high-level access to the account. The FBI notes that once permission is obtained, it can only be revoked by invalidating the token in the application security settings, not by changing the password. By registering malicious applications through legitimate authorization protocols, the attackers bypass both passwords and multifactor authentication.
Earlier iterations of the campaign impersonated event coordinators and planners, using invitations and identity verification requests as lures. The FBI has not disclosed how many people were compromised or the attackers' objectives. Its advice is to scrutinize communications from unfamiliar numbers or accounts, independently verify the sender's identity, and only grant access to trusted applications.
Why this is a GRC story
Consent phishing exploits a governance gap, not a technical one. Most organizations invest in passwords, MFA and endpoint controls, but few maintain a real inventory of the third-party applications that hold OAuth grants into their tenants. The attacker here does not need to steal a password; they need the victim to approve a request, and the grant then sits in the account's permissions as a persistent entitlement.
That makes this an identity governance problem. MFA is not a silver bullet when the victim is authorizing the attacker themselves. The controls that matter are app-grant governance: reviewing connected applications, enforcing allowlists of approved apps, monitoring new consent grants, and making revocation a documented, repeatable process. Conditional access policies and token expiry limits blunt the persistence of these grants.
There is also an executive protection angle. High-profile individuals, their families and their acquaintances are the target list, which means security awareness cannot stop at the general workforce. Executive briefings on consent phishing, verified channels for document review, and the discipline to type a URL rather than click one are cheap controls against a sophisticated lure.
What to watch
Watch for the FBI to name victims or counts as the investigation develops, and whether identity providers tighten app verification and consent prompts in response. For GRC teams, the immediate move is to audit OAuth grants across your cloud tenants, set up alerts for new third-party app consents, and brief your executives on how to check which apps hold access to their accounts.
Attribution: Analysis based on CyberScoop's reporting and related public reporting. This article is original commentary, not a repost of the source material.