The FBI has issued a warning about a growing type of cyberattack known as OAuth consent phishing. This method exploits the way users grant apps access to their online accounts, allowing attackers to access sensitive information without needing passwords. Victims are tricked into approving permissions for malicious apps, which then can read and send emails on their behalf. Unlike traditional phishing attacks, changing passwords does not stop this threat—users must manually revoke the special access tokens in their app settings. OAuth consent phishing has been around for over a year, but it has recently gained popularity enough to draw the attention of the FBI. The agency issued a public service announcement through its Internet Crime Complaint Center (IC3) to warn Americans about the dangers of this attack method. The technique relies on users unknowingly granting access to malicious apps through legitimate platforms, often with just one click. OAuth, or Open Authorization, is a standard that allows users to grant apps access to their accounts on another service without sharing their password. For example, when a user installs a new app and chooses to log in using their Google account, they are asked to approve the app’s access to their email. If approved, Google gives the app a special access token, which allows it to interact with the user's account without ever seeing the password. To pull off an OAuth attack, hackers first trick service providers like Google or Microsoft into registering their malicious app on the platform. They then contact potential victims through instant messaging, often impersonating government officials, media figures, or other public personalities. These messages include links to documents, which redirect users to legitimate services where they are asked to grant the malicious app access. If the user approves, the attackers gain full control over the email account and can perform nearly any action. The FBI has not disclosed the identities of the attackers or their specific targets, but noted that the victims were prominent individuals and that their family members were also targeted.