# FBI warns of OAuth consent phishing: the "Allow" button that survives a password reset

> The FBI warns that attackers use real Google and Microsoft sign-in pages plus a malicious app's Allow prompt to keep access to email. How to spot and revoke it.

Canonical: https://www.phishclean.com/blog/fbi-oauth-consent-phishing-warning
Last updated: 2026-09-25

September 25, 2026 - 6 min read

By [Chidambaram](https://www.phishclean.com/author/chidambaram), founder of PhishClean

On 1 September 2026 the FBI published a warning about a phishing technique that gets around most of the advice people know. The login page is real, the password is never stolen, and changing the password afterwards doesn't lock the attacker out.

The FBI's Internet Crime Complaint Center (IC3) issued public service announcement I-090126-PSA about "OAuth consent phishing". The FBI says the activity dates back to late 2025. It targets prominent people and, notably, their family members and personal acquaintances, through direct messages on commercial messaging apps. The messages come from people posing as journalists, officials and event coordinators.

## How consent phishing works

OAuth is the "Sign in with Google / Microsoft" system that lets one app get access to your account in another without seeing your password. Consent phishing turns that feature against you:

- **The app:** the attacker registers an app with a real OAuth provider and asks for broad permissions, such as reading and sending mail or reading files.
- **The lure:** a message invites you to view a document, verify your identity or join an event.
- **The real login:** you land on the genuine Google or Microsoft sign-in page. Your password goes to Google or Microsoft, not to the attacker.
- **The prompt:** a permission screen asks you to let the app access your account. You click *Allow*.
- **The access:** the attacker's app now has an access token and can read your email and files through the provider's own API.

In the FBI's words, once permission is granted the access "can only be revoked by the victim invalidating the token in their application security settings; not by changing the password."

## Why the usual advice doesn't help

"Check the address bar" doesn't help here, because the sign-in page is real. "Use MFA" doesn't either, because you completed MFA yourself. The attack succeeds at the consent screen, which most people click through without reading. That's why the FBI recommends approving only apps you already trust and checking who the sender really is through a separate channel before opening links from people you don't know.

## Read the consent screen before you click Allow

- **Who is asking?** The screen names the app and usually its publisher. An unfamiliar name attached to a "document viewer" or "verification" request is a warning sign.
- **What is it asking for?** Viewing a shared file doesn't need permission to read, send and delete all your email.
- **Did you go looking for this app?** If a message you didn't expect sent you here, close the tab.

## How to check and revoke app access now

Every major provider lists the third-party apps that have access to your account. In a Google account it's under Security → Your connections to third-party apps & services. In a Microsoft account, look in the privacy or security settings for the apps and services you've given access to; work accounts show this on the My Apps / My Account page. Remove anything you don't recognise, and check the list again after any suspicious message. For organisations, the stronger fix is administrative: stop users from consenting to unverified apps and route new app requests through an admin approval process.

## Where the browser fits in

Consent phishing is hard for any tool to catch, because nearly every page in the chain is legitimate. What a browser tool can do is catch the pages that aren't: the fake "shared document" landing page, the redirect through a lookalike domain, or a login form that sends your password somewhere unexpected. PhishClean checks those locally on every page. The consent screen still needs you to read it.

## Sources

- [FBI IC3 PSA I-090126-PSA: Malicious cyber actors gain access to victim accounts through consent phishing](https://www.ic3.gov/PSA/2026/PSA260901)

[OAuth redirect phishingWhen a trusted sign-in flow becomes the lure.](https://www.phishclean.com/blog/google-oauth-phishing-surge-2026) [Microsoft OAuth redirection abuseRedirects that end at malware.](https://www.phishclean.com/blog/microsoft-oauth-redirection-phishing-malware) [Session hijackingWhy tokens outlive passwords.](https://www.phishclean.com/threats/session-hijacking-attacks) [Can an extension steal my session?What permissions really mean.](https://www.phishclean.com/blog/can-a-browser-extension-steal-my-login-session)

## Catch the fake pages around the real one

PhishClean flags lookalike domains, fake document lures and login forms that post your password somewhere unexpected.

[Install PhishClean free](https://www.phishclean.com/#install)

Last updated: 25 September 2026