FBI Alerts Users to OAuth Consent Phishing that Bypasses Passwords via Google and Microsoft Permission Prompts

The Federal Bureau of Investigation issued a fresh advisory warning that a growing number of cybercriminals are exploiting the consent screens of popular services such as Google and Microsoft to hijack entire user accounts.

In the scheme, a malicious application masquerades as a legitimate tool and prompts the victim to click an "Allow" button on the standard OAuth permission dialog. Once the user consents, the attacker receives an access token that grants the same privileges as the user, allowing the thief to read and send email, scrape contacts, and potentially access cloud‑based documents.

Because the breach occurs at the token level rather than through a stolen password, resetting the password offers little protection; the granted token remains active until the owner explicitly revokes it in the account's security or app‑management settings. This token‑based loophole is what makes the attack especially pernicious.

Federal officials and cybersecurity experts recommend a two‑step remediation. First, users should review the list of connected applications in their Google or Microsoft account dashboards and immediately revoke any unfamiliar or suspicious entries. Second, enabling multi‑factor authentication adds an extra barrier that can deter unauthorized token creation, though it does not replace the need to clean up existing tokens.

OAuth consent phishing is not entirely new, but the FBI notes a sharp uptick over the past several months, coinciding with broader trends of credential‑stuffing and business‑email‑compromise campaigns. Earlier variants focused on tricking users into entering passwords on fake login pages; the current approach leverages the inherent trust users place in the official permission UI.

The potential fallout is significant. Once an attacker controls an email account, they can impersonate the victim, launch spear‑phishing attacks on colleagues or partners, and exfiltrate sensitive information. For organizations, a single compromised account can open pathways to larger network intrusions and financial loss.

The bureau urges anyone who suspects exposure to report the incident through the Internet Crime Complaint Center and to stay vigilant for unexpected permission requests. Meanwhile, technology firms are expected to review how consent dialogs are presented, possibly adding clearer warnings or additional verification steps to curb the misuse of OAuth tokens.