FBI Warns of Sophisticated OAuth Phishing Campaign Targeting High-Profile Individuals

WASHINGTON — The Federal Bureau of Investigation issued an urgent alert on Monday warning that cyber actors are launching a deceptive phishing campaign designed to compromise the accounts of prominent individuals, their families, and close acquaintances. The attack leverages a technique known as OAuth consent phishing to bypass traditional password defenses on commercial messaging applications.

The FBI stated that the campaign does not require victims to surrender login credentials. Instead, attackers trick users into authorizing malicious applications through legitimate-looking consent prompts. Once a victim grants permission, the threat actors gain long-term access to the target's account and sensitive data without ever needing a password. This method allows the intruders to maintain persistent presence within the compromised accounts, evading standard security measures that rely on detecting incorrect login attempts.

The warning highlights a shift in tactics used by cybercriminals who are increasingly targeting high-value individuals. The scope of the operation extends beyond the primary targets to include their personal networks, including family members and friends who communicate via popular messaging platforms. By infiltrating these circles, attackers aim to harvest private conversations, financial information, and other confidential data stored within the applications.

The Bureau emphasized that the deceptive nature of the campaign relies on social engineering rather than technical exploits of the messaging apps themselves. Users are presented with requests that appear to come from trusted sources or legitimate services, prompting them to click "allow" or "authorize." Because the authentication process is handled by the application provider, the transaction appears secure to the user, masking the malicious intent behind the authorization.

Security officials noted that this method poses a significant challenge for detection, as the access granted is technically valid from the perspective of the service provider. Unlike brute-force attacks or credential stuffing, which generate alerts for failed login attempts, OAuth consent phishing leaves no immediate trace of unauthorized entry until the attacker begins exfiltrating data or engaging in suspicious activity.

The FBI has not identified a specific group responsible for the campaign but advised users to remain vigilant regarding authorization requests. The agency recommended that individuals carefully review any prompts asking for access to their accounts, particularly those originating from unknown sources or unexpected contexts. Users are urged to revoke permissions for any unfamiliar applications immediately through their account settings.

As of Monday evening, no specific incidents involving named public figures have been confirmed by the Bureau. It remains unclear how widespread the campaign is or whether any data has already been successfully exfiltrated. The FBI continues to monitor the situation and will provide further updates as more information becomes available regarding the scale and origin of the threat.