On 1 September the FBI’s Internet Crime Complaint Center published a public service announcement on OAuth consent phishing. Since late 2025, it says, attackers have been messaging the personal accounts of prominent individuals, their family members and acquaintances with links to a real Google or Microsoft permission screen. The victim signs in and clicks Allow. The attacker’s application can then read and send their email, and continues to after the password is changed.
On 20 August Google’s Threat Intelligence Group published a report on three suspected Russian espionage clusters using the same lures against the same kinds of people. It named the clusters and published the domains. The FBI announcement does not cite it. Google does not cite the FBI.
The FBI’s version
The PSA, alert I-090126-PSA, describes attackers impersonating government officials, media figures and public personalities on a commercial messaging application and sending a link dressed up as a file-sharing service. Earlier waves impersonated event organisers whose invitations required the target to verify their identity through an application the attacker controlled. The FBI’s flowchart adds a fake journalist or academic asking the target to review a draft.
On remediation the FBI is specific. Access “can only be revoked by the victim invalidating the token in their application security settings; not by changing the password.”
The PSA gives no attribution, no victim count and no indicators. The advice is three lines long: scrutinise messages from unfamiliar numbers, verify senders independently, only authorise trusted applications. It does not say where the application security settings are.
Google’s version
GTIG tracks three clusters. Two, UNC6293 and UNC7005, are assessed with moderate confidence as initial-access subclusters of ICE RELIC, the group formerly tracked as APT29. The third, UNC5976, is assessed as Russian. Targets are academics, diplomats, think-tank staff and defence industry personnel in Europe and the United States, reached through personal accounts.
UNC7005 built a registration page spoofing the GLOBSEC forum. UNC5976 bought file-sharing themed domains, put a “Continue with Google” button on a fake sharing page, and routed victims through a real Google OAuth login before redirecting them to an attacker-controlled cloud project that harvested the token. UNC6293, first reported by Google in June 2025 for phishing app-specific passwords while impersonating the US State Department, added OAuth phishing in June 2026.
GTIG says it disabled the cloud projects and that UNC5976 is moving its infrastructure to other providers. It does not say which.
The FBI does not attribute the campaign. Google does not claim it. The lures, targets and timing overlap. Google also describes app-password phishing, device-code phishing and token theft via redirect alongside consent phishing proper, and the FBI’s start date of late 2025 is six months later than Google’s.
Where the fixes went
Microsoft spent the second half of 2025 changing consent defaults. From mid-July 2025, Microsoft 365 tenants on default settings required administrator approval before a third-party application could access files and sites. From late October the same policy covered Exchange and Teams content. A user on a default tenant can no longer approve an application that wants to read their mailbox.
A personal Outlook.com account has no tenant and no administrator. The FBI says the victims are being reached through personal accounts.
Google’s option for high-risk users is the Advanced Protection Program, which blocks applications requesting high-risk Gmail and Drive scopes unless they are Google’s own, Apple’s native iOS apps or Thunderbird, and prevents the creation of app passwords. It is opt-in, requires a passkey or security key and disables most third-party mail clients.
For everyone else, Google’s report says it shows an “unverified app” warning before the consent screen for unverified, testing-mode cloud projects requesting sensitive scopes “in specific scenarios”. GTIG’s own description of the UNC5976 flow is a legitimate Google OAuth login followed by a redirect to an unverified, testing-mode cloud project. The report does not say whether the warning appeared.
Why this is a mailbox story
GTIG notes the initial outreach likely arrives over encrypted messaging applications and the compromised accounts are personal, so corporate monitoring sees nothing. There is no sender to authenticate and no attachment to scan. The attacker’s application is registered with the provider, the permission screen belongs to the provider, and so does the token.
What an unverified application may request, how clearly the screen says who is asking, whether a password reset surfaces existing grants, and whether consumer defaults will follow the enterprise ones are all decisions the providers make.
If you think it has happened to you
- Google: Third-party apps with account access. Remove anything you do not recognise. Remove any app passwords you did not create.
- Microsoft personal accounts: Apps and services that can access your data. Remove anything you do not recognise.
Then change the password. Then report to IC3 and keep the screenshots.
Sources: FBI IC3 PSA I-090126-PSA (1 September 2026); Google Threat Intelligence Group, “Going with the Flow(s)” (20 August 2026); Microsoft 365 Message Center MC1097272 and MC1163922; Google Advanced Protection Program documentation. Google and Microsoft were not approached for comment.
