The FBI Just Told You Your Password Doesn't Matter

Nobody stole a password. Nobody beat MFA. Somebody clicked "Allow."

That's the whole attack, and the FBI put out a public service announcement about it this morning.

The technique is OAuth consent phishing. Campaigns have been running since late 2025 against prominent people, their families, and their friends. Read that again. Families. Friends. The attackers skipped the executive's corporate mailbox and went for the spouse's Gmail, because nobody's protecting it and the access is nearly as good.

What the FBI actually said

Somebody messages you on WhatsApp, Signal, Telegram, whatever. The FBI just says "commercial messaging application" and won't name names. They claim to be a government official, a journalist, a conference organizer. There's a link. It's a shared file, or an event invite that needs you to "verify your identity" first.

The link goes to a real Microsoft or Google login page. You sign in with your real password and your real MFA. Nothing about that step is fake. Then a consent screen asks if "SecureDocs Viewer" can read and write your files and email.

You click Allow. Done.

The attacker now holds a token that lets them, in the FBI's words, "act on behalf of the user, including reading and sending emails, and accessing sensitive data without having access to the user's credentials."

And here's the line every help desk should tape to the wall: once permission is granted, "it can only be revoked by the victim invalidating the token in their application security settings; not by changing the password."

Reset the password. Doesn't matter. Re-enrol MFA. Doesn't matter. The attacker never needed either one.

Why this one slides past everything

Regular phishing steals something. A password, a session cookie, a code. Consent phishing steals nothing. You hand over a real, platform-issued authorization, and the platform honours it exactly the way it was built to.

No exploit. No malware. Just a valid grant.

So every control you bought sits there and watches. The password manager doesn't flag it because the login page is real. MFA doesn't stop it because the user did MFA correctly. Conditional access checks the sign-in, not the app that shows up thirty seconds later asking for Mail.ReadWrite. EDR sees nothing because nothing ran.

And it's quiet. A stolen password gets noticed when someone resets it. A rogue OAuth grant sits in a settings page nobody opens, with a refresh token that renews itself forever. The attacker reads mail, adds a forwarding rule, waits for the wire transfer thread, and never trips a login alert. They never log in.

None of this is new. Microsoft has been publishing consent phishing guidance since 2020. What's new is the volume. Proofpoint has tracked a sharp climb in OAuth abuse since September 2025: a suspected Russia-aligned crew working government and think-tank targets, plus straight criminal operators running the same play with off-the-shelf kits. The FBI PSA is the government catching up to a year of telemetry.

The part the PSA won't say

The FBI's advice is fine. Be suspicious of unknown senders. Verify independently. Only authorize apps you trust.

That's user advice for a platform problem.

Microsoft and Google both ship with user consent switched on by default. Any user in your tenant can hand any third-party app their mail and files. No admin, no review. That's not an oversight. Friction on consent slows down the app marketplace, and the marketplace is the business. So they leave the door open, hang a "be careful" sign on it, and the FBI reads you the sign.

Telling a CEO's spouse to scrutinize unfamiliar messages isn't a control. It's a hope. The person pretending to be a conference organizer has the real conference name, the real dates, the real speaker list. Looking right is their entire job.

The control is a tenant setting. Most organizations have never opened it.

What to actually do

If you run Microsoft 365 or Google Workspace, or you're the MSP that runs it for someone else, here's the list. Not easy. Short.

Turn off user consent. In Entra, set user consent to "Do not allow," or at minimum limit it to verified publishers with low-risk permissions, and turn on the admin consent workflow so someone with a spine gets to say no. In Google Workspace, block unconfigured third-party apps and allowlist the ones you've looked at. This one setting ends the attack class inside your tenant. Staff will grumble when their new calendar tool won't connect. Take the grumbling.

Audit what's already in there. Every tenant I've looked at has apps nobody recognizes. Pull the enterprise app list and the OAuth grants, sort by date, and look for anything with mail or file scopes consented by a regular user. Revoke what you can't explain. Then check the mailbox rules on those accounts, because external forwarding is the first thing these operators set up.

Alert on new grants. A new consent with Mail.Read, Mail.Send, Files.ReadWrite, or offline_access should page a human. Not a weekly report. A page. In a locked-down tenant, new grants are rare, so the alert almost never lies to you.

Fix your IR playbook. If your account-compromise runbook says "reset password, kill sessions, re-register MFA" and stops there, it's wrong for this. Add "revoke all OAuth grants and refresh tokens." Make it step one, because it's the only step that actually kicks the attacker out.

Cover the people who aren't in your tenant. The FBI got this part right and most security programs ignore it. Your executives, board members, and their families are running personal Google and Microsoft accounts you don't manage. You can't push policy to them. You can sit down with them for twenty minutes, open the connected-apps page together, revoke the junk, and give them the one rule: nobody legitimate needs you to "verify your identity" through a consent screen to open a file or accept an invitation. Ever.

The caveat

Consent phishing is still a small slice of account takeovers. Credential stuffing and plain password phishing dwarf it and will for a while. If you don't have MFA everywhere yet, do that first. Don't let this be the reason you skip the basics.

But every organization that gets MFA right pushes attackers toward the paths that don't care about MFA. This is the cleanest one. And the FBI issuing a PSA means it has moved from research blog to case file.

Bottom line

We spent ten years teaching people to protect their passwords. The attackers built something that never asks for one.

More awareness training won't fix that. A tenant setting most admins have never opened will. So will an alert most SOCs have never built, and a twenty-minute conversation with your executives' families that nobody has put on a calendar.

The FBI told you changing the password won't get the attacker out. Go find out how many of your users could let one in with a single click.