# FBI/IC3 PSA260901: OAuth Consent Phishing Campaign Targeting High-Profile Individuals via Commercial Messaging Apps

> The FBI's Internet Crime Complaint Center (IC3, PSA260901, issued 2026-09-01) warns that since late 2025 threat actors have targeted prominent individuals, their family members, and acquaintances through direct messages on commercial messaging applications, impersonating government officials, journalists, event coordinators, and other public figures to lure victims into authorizing a malicious OAuth application. The resulting access token bypasses both passwords and MFA and persists until the victim manually revokes it in their account security settings — a password reset alone does not remove it — exposing emails, files, and other sensitive data. No CVE, technical IOC, or attribution was disclosed by the FBI.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-09-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2286
- **ID:** TL-2026-2286
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-01 the FBI's Internet Crime Complaint Center (IC3) published Public Service Announcement PSA260901 warning of an active OAuth consent-phishing campaign, running since late 2025, that specifically targets prominent, high-profile individuals along with their family members and personal acquaintances. The attack begins with a direct message on a commercial messaging application (CMA) in which the actor impersonates a government official, journalist, media personality, event coordinator, or planner to establish a plausible pretext — for example, a request to review a draft article or verify an identity — before sending a link framed as a file-sharing invitation.

Unlike credential-phishing or classic AiTM (adversary-in-the-middle) attacks, the victim is not asked for a password. Clicking the link redirects the victim to the legitimate authorization/consent screen of a real identity provider (the FBI names Microsoft and Google), where they authenticate normally — completing any MFA challenge exactly as they would for a trusted login. The difference is what happens next: the victim is then asked to approve a permissions ('consent') request from an application under the attacker's control. If approved, the attacker's application receives an OAuth access/refresh token scoped to whatever permissions were granted (the FBI describes 'full visibility into the target's configured permissions,' enabling access to emails, files, and other sensitive data).

This is the defining danger the FBI calls out: because the token is a bearer credential issued by the identity provider directly to the attacker's registered application, it is functionally independent of the victim's password. It survives a password reset and can only be terminated by the victim explicitly finding and revoking the application's authorization in their account's app/security settings — a step most users do not know exists or think to take. The FBI states plainly that the technique 'bypass[es] both passwords and multi-factor authentication.'

The FBI PSA discloses no attribution, no named malicious application, domain, or other network/host IOC, and no confirmed victim count — it is a technique-and-targeting warning, not an incident-forensics report. This research therefore documents the disclosed campaign precisely as reported while drawing on parallel, independently-sourced reporting to ground the surrounding technique family: security researchers (Obsidian Security) have cataloged OAuth/consent-phishing as a growing attack class with at least five distinct patterns as of late 2025/2026 — device-code phishing, platform-hosted 'CoPhish' consent abuse inside a victim's own tenant, commodity attack kits (SquarePhish, Graphish) that a BleepingComputer/Infosecurity Magazine-reported wave since September 2025 attributes in part to the financially-motivated group TA2723 and the Russia-aligned UNK_AcademicFlare, admin-consent impersonation, and the browser-native 'ConsentFix' ClickFix variant. None of these named actors, kits, or campaigns is confirmed by the FBI to be the operator behind PSA260901's specific high-profile-individual targeting; they are documented here as the broader, contemporaneous threat landscape in which this PSA sits. Separately, the tactic of impersonating officials to lure prominent individuals (journalists, NGO staff, government-adjacent researchers) into an account-linking action on a commercial messaging app has a well-documented precedent in the Russian FSB-linked actor Star Blizzard (aka COLDRIVER/Callisto Group/SEABORGIUM), which CISA/NCSC (advisory AA23-341A) and subsequent reporting describe using WhatsApp-group invitations and QR-code account-linking against similar victim profiles — a TTP overlap worth tracking, but again not an attribution the FBI has made for this specific campaign.

Defensively, the core control gap this PSA highlights is that identity providers' consent screens are, by design, legitimate-looking and hosted on the real provider's domain, so neither URL inspection nor password/MFA hygiene detects the abuse — only scrutiny of which third-party application is requesting which permissions, and periodic review/revocation of authorized applications, closes the gap.

## MITRE ATT&CK

- T1588.002 Tool
- T1585.001 Social Media Accounts
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1098.001 Additional Cloud Credentials
- T1098.001 Additional Cloud Credentials
- T1550.001 Application Access Token
- T1528 Steal Application Access Token
- T1114.002 Remote Email Collection
- T1530 Data from Cloud Storage

## Sources

- [FBI/IC3 Public Service Announcement PSA260901 — OAuth Consent Phishing Targeting Prominent Individuals](https://www.ic3.gov/PSA/2026/PSA260901)
- [FBI raises alarm over deceptive phishing campaign targeting prominent people](https://cyberscoop.com/fbi-alert-oauth-consent-phishing-campaign/)
- [FBI raises alarm over deceptive phishing campaign targeting prominent people (mirror)](https://www.hendryadrian.com/fbi-raises-alarm-over-deceptive-phishing-campaign-targeting-prominent-people/)
- [Consent Phishing: How OAuth Attacks Bypass MFA and Traditional Security Controls](https://www.obsidiansecurity.com/blog/consent-phishing-how-oauth-attacks-bypass-mfa-and-traditional-security-controls)
- [Microsoft 365 accounts targeted in wave of OAuth phishing attacks](https://www.bleepingcomputer.com/news/security/microsoft-365-accounts-targeted-in-wave-of-oauth-phishing-attacks/)
- [OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365](https://www.infosecurity-magazine.com/news/oauth-phishing-campaigns/)
- [Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-Phishing Campaigns (AA23-341A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a)
- [Russia's Star Blizzard caught compromising WhatsApp accounts](https://www.theregister.com/2025/01/16/russia_star_blizzard_whatsapp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2286