Threat reportPhishingTL-2026-2286
FBI/IC3 PSA260901: OAuth Consent Phishing Campaign Targeting High-Profile Individuals via Commercial Messaging Apps
FBI/IC3 PSA260901 (TL-2026-2286) is a high-severity phishing campaign, first published 2026-09-01. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID OAuth authorization framework, maps to 10 MITRE ATT&CK techniques (T1098.001, T1114.002, T1204.001), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-2286
- Threat ID
- TL-2026-2286
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, news - media
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in FBI/IC3 PSA260901
Malware and tooling: First-party application abuse (e.g., Azure CLI OAuth app), Graphish, SquarePhish (v1/v2)
How FBI/IC3 PSA260901 works
The FBI's Internet Crime Complaint Center (IC3, PSA260901, issued 2026-09-01) warns that since late 2025 threat actors have targeted prominent individuals, their family members, and acquaintances through direct messages on commercial messaging applications, impersonating government officials, journalists, event coordinators, and other public figures to lure victims into authorizing a malicious OAuth application. The resulting access token bypasses both passwords and MFA and persists until the victim manually revokes it in their account security settings — a password reset alone does not remove it — exposing emails, files, and other sensitive data. No CVE, technical IOC, or attribution was disclosed by the FBI.
On 2026-09-01 the FBI's Internet Crime Complaint Center (IC3) published Public Service Announcement PSA260901 warning of an active OAuth consent-phishing campaign, running since late 2025, that specifically targets prominent, high-profile individuals along with their family members and personal acquaintances. The attack begins with a direct message on a commercial messaging application (CMA) in which the actor impersonates a government official, journalist, media personality, event coordinator, or planner to establish a plausible pretext — for example, a request to review a draft article or verify an identity — before sending a link framed as a file-sharing invitation.
Unlike credential-phishing or classic AiTM (adversary-in-the-middle) attacks, the victim is not asked for a password. Clicking the link redirects the victim to the legitimate authorization/consent screen of a real identity provider (the FBI names Microsoft and Google), where they authenticate normally — completing any MFA challenge exactly as they would for a trusted login. The difference is what happens next: the victim is then asked to approve a permissions ('consent') request from an application under the attacker's control. If approved, the attacker's application receives an OAuth access/refresh token scoped to whatever permissions were granted (the FBI describes 'full visibility into the target's configured permissions,' enabling access to emails, files, and other sensitive data).
This is the defining danger the FBI calls out: because the token is a bearer credential issued by the identity provider directly to the attacker's registered application, it is functionally independent of the victim's password. It survives a password reset and can only be terminated by the victim explicitly finding and revoking the application's authorization in their account's app/security settings — a step most users do not know exists or think to take. The FBI states plainly that the technique 'bypass[es] both passwords and multi-factor authentication.'
The FBI PSA discloses no attribution, no named malicious application, domain, or other network/host IOC, and no confirmed victim count — it is a technique-and-targeting warning, not an incident-forensics report. This research therefore documents the disclosed campaign precisely as reported while drawing on parallel, independently-sourced reporting to ground the surrounding technique family: security researchers (Obsidian Security) have cataloged OAuth/consent-phishing as a growing attack class with at least five distinct patterns as of late 2025/2026 — device-code phishing, platform-hosted 'CoPhish' consent abuse inside a victim's own tenant, commodity attack kits (SquarePhish, Graphish) that a BleepingComputer/Infosecurity Magazine-reported wave since September 2025 attributes in part to the financially-motivated group TA2723 and the Russia-aligned UNK_AcademicFlare, admin-consent impersonation, and the browser-native 'ConsentFix' ClickFix variant. None of these named actors, kits, or campaigns is confirmed by the FBI to be the operator behind PSA260901's specific high-profile-individual targeting; they are documented here as the broader, contemporaneous threat landscape in which this PSA sits. Separately, the tactic of impersonating officials to lure prominent individuals (journalists, NGO staff, government-adjacent researchers) into an account-linking action on a commercial messaging app has a well-documented precedent in the Russian FSB-linked actor Star Blizzard (aka COLDRIVER/Callisto Group/SEABORGIUM), which CISA/NCSC (advisory AA23-341A) and subsequent reporting describe using WhatsApp-group invitations and QR-code account-linking against similar victim profiles — a TTP overlap worth tracking, but again not an attribution the FBI has made for this specific campaign.
Defensively, the core control gap this PSA highlights is that identity providers' consent screens are, by design, legitimate-looking and hosted on the real provider's domain, so neither URL inspection nor password/MFA hygiene detects the abuse — only scrutiny of which third-party application is requesting which permissions, and periodic review/revocation of authorized applications, closes the gap.
MITRE ATT&CK techniques used in TL-2026-2286
Persistence
T1098.001 Additional Cloud Credentials
Privilege Escalation
T1098.001 Additional Cloud Credentials
Collection
T1114.002 Remote Email Collection; T1530 Data from Cloud Storage
Execution
Credential Access
T1528 Steal Application Access Token
lateral-movement
T1550.001 Application Access Token
Initial Access
Resource Development
T1585.001 Social Media Accounts; T1588.002 Tool
stealth
Affected products and versions in FBI/IC3 PSA260901
- Microsoft — Microsoft 365 / Entra ID OAuth authorization framework
Vulnerable versions: N/A — social-engineering abuse of the standard OAuth consent flow, not a software version defect
Fixed in: N/A — mitigated via consent-policy configuration, not a vendor patch - Google — Google Workspace / Google Account OAuth authorization framework
Vulnerable versions: N/A — social-engineering abuse of the standard OAuth consent flow, not a software version defect
Fixed in: N/A — mitigated via consent-policy configuration, not a vendor patch
Remediation for FBI/IC3 PSA260901
Immediate actions
- Independently verify the identity of any contact soliciting review of a document or account action via direct message on a commercial messaging app, even if they claim to be a known official, journalist, or event coordinator (FBI/IC3 PSA260901)
- Review and revoke unfamiliar or unused third-party application authorizations — Microsoft: account.microsoft.com / myapps.microsoft.com app permissions; Google: myaccount.google.com/permissions — because a password change alone does NOT revoke a granted OAuth token (FBI/IC3 PSA260901)
- Audit sign-in and application-consent/audit logs for VIP and high-profile accounts for recently-granted third-party OAuth applications with broad scopes
Workarounds
- For high-risk/VIP accounts, disable end-user consent to third-party applications entirely and route any needed app authorization through a manual admin-review process until reviewed
Longer-term hardening
- Restrict end-user consent to unverified third-party applications via admin-consent workflows and app-consent policies (e.g., Entra ID app consent policies / Google Workspace API access control) so a direct-message lure cannot alone grant durable access (Obsidian Security)
- Deploy continuous monitoring for OAuth application risk indicators — newly registered apps, broad scopes such as Mail.Read/Files.ReadWrite.All, unverified publishers requesting admin consent, unusual redirect URIs (Obsidian Security)
- Extend VIP/executive-protection security awareness training to cover consent-phishing specifically, since it does not resemble a traditional password-phishing page
Timeline of FBI/IC3 PSA260901
- CISA/NCSC jointly publish advisory AA23-341A on Star Blizzard (COLDRIVER/Callisto Group), a Russia-linked actor with a documented precedent of impersonating officials to lure journalists, NGOs, and government-adjacent researchers — a TTP overlap with PSA260901's pretext pattern, though not attributed to it.
- Star Blizzard reported compromising victims' WhatsApp accounts via QR-code account-linking after impersonating U.S. officials in invitations to Ukraine-support groups, establishing a documented precedent for messaging-app-delivered impersonation lures against high-profile targets.
- Independent reporting (BleepingComputer, Infosecurity Magazine) marks a sharp increase in OAuth device-code phishing activity against Microsoft 365 accounts beginning around September 2025, involving the financially-motivated group TA2723 and the Russia-aligned UNK_AcademicFlare.
- FBI/IC3 PSA260901 states the OAuth consent-phishing campaign against prominent individuals, their family members, and acquaintances began in this approximate period ('since late 2025').
- A concurrent OAuth device-code phishing campaign using a fake 'Salary Bonus + Employer Benefit Reports 25' document lure is detected, illustrating the same OAuth-consent-abuse technique family active in the same window as PSA260901's reporting period.
- BleepingComputer and Infosecurity Magazine publish reporting on the OAuth device-code phishing wave (SquarePhish, Graphish kits; TA2723, UNK_AcademicFlare), documenting the broader technique landscape surrounding consent phishing.
- CyberScoop publishes coverage of the FBI/IC3 warning, adding detail on the impersonation pretexts (draft-article review, identity verification) used to solicit OAuth consent.
- FBI's Internet Crime Complaint Center (IC3) issues Public Service Announcement PSA260901, formally warning of the OAuth consent-phishing campaign targeting prominent, high-profile individuals via commercial messaging applications.
Sources cited for FBI/IC3 PSA260901
- FBI/IC3 Public Service Announcement PSA260901 — OAuth Consent Phishing Targeting Prominent Individuals
- FBI raises alarm over deceptive phishing campaign targeting prominent people
- FBI raises alarm over deceptive phishing campaign targeting prominent people (mirror)
- Consent Phishing: How OAuth Attacks Bypass MFA and Traditional Security Controls
- Microsoft 365 accounts targeted in wave of OAuth phishing attacks
- OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365
- Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-Phishing Campaigns (AA23-341A)
- Russia's Star Blizzard caught compromising WhatsApp accounts
Detection coverage for TL-2026-2286
As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2286 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.