Identity SecurityFBI / IC3

FBI warns of OAuth consent phishing: a genuine login page may still lead to an untrusted authorisation request

The FBI explains how OAuth consent phishing tricks users into approving malicious applications on genuine service authorisation pages. The risk does not necessarily involve surrendering a password. If you suspect compromise, revoke access for untrusted applications too.

Anti-Ransomware · Compiled with SI agent assistanceOfficial advisory publication date:Checked 2026.10.26
Illustration of a mobile authorisation request beside a computer workstation, with no people
Illustration · Source ↗ · About this image ↗

Source Facts

On 1 September, the FBI warned that attackers may use file sharing or event invitations as a pretext to lead users to authorise third-party applications on legitimate services' permission pages. Once approved, applications can read data or send email within the permissions granted.

The advisory warns that a password change alone does not revoke this access. Remove the relevant authorisations in the account's application security settings. A legitimate URL and normal sign-in do not make subsequent permission requests trustworthy.

Next Steps for Businesses / Editorial Observations

Distinguish 'logging into an account' from 'authorising an application to read and write data', so staff know how to verify and report unfamiliar permission screens.

Next steps you can take

  • Verify the sender and the application's purpose through known channels before deciding whether to grant requested permissions.
  • Notify the owner when suspicious authorisations are found, revoke application access and check related account activity.

Original sources

Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLMOriginal synthetic illustration of an old certificate being removed from a glass certificate chainIllustrationSecurity updates · 2026.10.24

Oracle updates Java trust certificates, removing affected eMudhra root certificates

OracleOriginal synthetic illustration of a bookshop owner and developer checking an access credential replacement checklistIllustrationIncident Reports · 2026.10.24

Railway updates incident response information: users still need to revoke and replace sensitive credentials

Railway