Home / Technology / New FBI Phishing Attack Bypasses Passwords and 2FA
New FBI Phishing Attack Bypasses Passwords and 2FA
4 Sep
Summary
- A new FBI warning details OAuth consent phishing attacks.
- This attack bypasses traditional password and 2FA security.
- Attackers gain access by tricking users into authorizing malicious apps.
The FBI's Internet Crime Complaint Center issued a public service announcement on September 1, 2026, detailing a growing threat known as OAuth consent phishing. This deceptive technique allows attackers to gain access to user accounts without needing passwords.
OAuth is the system behind "Sign in with" buttons, enabling third-party apps to access services without handling user credentials directly. Attackers exploit this by impersonating trusted contacts or services to send malicious links. These links lead to legitimate-looking login pages, where users unwittingly grant access to unauthorized applications.
Unlike conventional phishing, resetting passwords or using two-factor authentication codes does not revoke access once an OAuth token is compromised. The FBI stresses that victims must manually revoke these tokens in their account security settings. This sophisticated attack is escalating, with security researchers documenting 10 to 15 new operations daily, and millions of attacks recorded recently.
Security solutions like NordVPN's Threat Protection Pro can help by blocking malicious domains before they load, cutting the attack chain early. Additionally, features like Dark Web Monitor can alert users if their data appears on cybercrime forums, providing an early warning of a breach.
