OAuth consent phishing targets high-profile individuals via CMAs

Since late 2025, cyber actors have been conducting OAuth consent phishing attacks against prominent victims and their contacts through commercial messaging applications, bypassing passwords and MFA by tricking users into granting persistent account access to malicious apps.

The FBI has observed a sustained campaign since late 2025 in which malicious actors target high-profile individuals, their family members, and personal associates via commercial messaging applications (CMAs). Attackers impersonate government officials, media personalities, event coordinators, and other trusted figures to trick victims into clicking malicious links. OAuth consent phishing exploits a fundamental weakness in OAuth authorization flows: once a user grants permission to a malicious application masquerading as a legitimate service, the attacker gains persistent, high-level access to the victim's account—including the ability to read and send emails, access sensitive data, and act on the victim's behalf.

The technique is particularly dangerous because it bypasses both passwords and multi-factor authentication entirely. Unlike credential harvesting or malware deployment, OAuth consent phishing does not require the attacker to possess the user's credentials; the victim themselves delegate access by approving a fake authorization prompt. The persistence of this access is a critical differentiator: the attacker retains privileges until the victim manually revokes the malicious application's token in their security settings—a step many users may not know to take or may not discover until long after the compromise.

Defenders should focus on detection of anomalous third-party application grants, user education on authorization flows, and monitoring for unauthorized account activity that may indicate a compromised OAuth token. Organizations should also implement policies requiring users to review and audit connected third-party applications regularly.

title: Suspicious OAuth Token Grant via Browser
description: Detects browser processes navigating to OAuth authorization endpoints
  (accounts.google.com/o/oauth2/auth, login.microsoftonline.com/oauth2/v2.0/authorize,
  etc.) with suspicious redirect_uri parameters pointing to attacker infrastructure
  or data exfiltration domains. Targets the consent-phishing vector where victims
  grant token access to malicious apps.
tags:
- attack.initial-access
- attack.t1528
- attack.t1566.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
    - \chrome.exe
    - \firefox.exe
    - \iexplore.exe
    - \msedge.exe
  selection_oauth_url:
    CommandLine|contains:
    - accounts.google.com/o/oauth2/auth
    - login.microsoftonline.com/oauth2/v2.0/authorize
    - accounts.google.com/signin/oauth
  selection_suspicious_param:
    CommandLine|contains:
    - redirect_uri=http://
    - redirect_uri=file://
    - response_type=token
  filter_legitimate_apps:
    CommandLine|contains:
    - redirect_uri=https://localhost
    - redirect_uri=https://127.0.0.1
  condition: (selection_browser and selection_oauth_url and selection_suspicious_param)
    and not filter_legitimate_apps
falsepositives:
- Legitimate OAuth integrations with http redirects in dev/test environments
- Enterprise applications performing authorized OAuth flows during setup
level: high
id: befd5bfa-9ac5-5212-8da6-b7552527508c
status: experimental
author: Vorant

title: Unauthorized Third-Party Application Access to Email
description: Detects mail client or webmail API calls from unusual application identifiers,
  suspicious user-agents, or bulk email operations that indicate an attacker using
  a stolen OAuth token to read or send mail. Focuses on behavioural anomalies in token
  usage rather than specific app IDs.
tags:
- attack.lateral-movement
- attack.t1550.001
- attack.t1528
logsource:
  category: network_connection
  product: windows
detection:
  selection_mail_api:
    DestinationHostname|contains:
    - graph.microsoft.com
    - mail.google.com
    - outlook.office365.com
    - imap.gmail.com
    DestinationPort:
    - 443
    - 587
    - 993
  selection_suspicious_pattern:
    UserAgent|contains:
    - python-requests
    - curl
    - wget
    - Invoke-WebRequest
    OR CommandLine|contains:
    - 'Authorization: Bearer'
    - client_id=
  filter_legitimate_clients:
    Image|endswith:
    - \outlook.exe
    - \thunderbird.exe
  condition: (selection_mail_api and selection_suspicious_pattern) and not filter_legitimate_clients
falsepositives:
- Automation tools and scripts legitimately accessing mail APIs
- Third-party mail sync applications with explicit user consent
level: medium
id: 814bb795-cbb5-5981-b93a-44c947a07cae
status: experimental
author: Vorant

title: Email Rule Creation from Suspicious OAuth Application
description: Detects unauthorized creation or modification of Outlook mail rules via
  APIs or registry modifications initiated by unfamiliar or suspicious application
  tokens. OAuth token thieves often create rules to forward emails, delete messages,
  or hide evidence of compromise.
tags:
- attack.persistence
- attack.t1137.005
- attack.t1550.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_outlook_rule_creation:
    Image|endswith: \powershell.exe
    CommandLine|contains:
    - New-InboxRule
    - Set-InboxRule
    - graph.microsoft.com/v1.0/me/mailFolders
  selection_api_token:
    CommandLine|contains:
    - 'Authorization: Bearer'
    - -AccessToken
  filter_admin_context:
    ParentImage|endswith:
    - \svchost.exe
    - \services.exe
  condition: (selection_outlook_rule_creation and selection_api_token) and not filter_admin_context
falsepositives:
- IT administrators managing rules via PowerShell with legitimate tokens
- Exchange on-premises rule management scripts
level: high
id: e4a20726-22f2-5a69-8d06-f2868d221868
status: experimental
author: Vorant

Source reporting: https://www.ic3.gov/PSA/2026/PSA260901