FBI Alert: OAuth Consent Phishing Is Targeting Users of Messaging Apps
KnowBe4, Friday, September 11th, 2026
The FBI warns of OAuth consent attacks granting account access without ever needing a password.
The FBI has issued a warning about OAuth consent phishing targeting prominent individuals, their family members and personal acquaintances.
The technique manipulates users into authorizing application access to their accounts, which grants persistent access without a password and therefore survives password resets and is unaffected by multi-factor authentication.
Defending against it requires controlling which third-party applications users may consent to, a setting many organizations leave permissive, and auditing existing grants that were approved without review.