How consent phishing can take over an account.

The dangerous click may not submit a password. It may authorize a malicious application to read data through a real sign-in system.

Traditional phishing imitates a login page to steal credentials. Consent phishing takes a different route: the attacker registers an application and persuades a person to grant it access through a legitimate authorization screen.

The FBI warned in September 2026 that malicious applications can be given permissions to read or write email, files and other account data. Because the victim approves access through a real identity provider, passwords and multifactor authentication may not stop the resulting authorization.

What the request looks like

A message may appear to come from a journalist, colleague, event organizer or known institution. The recipient is asked to review a document, accept an invitation or verify an identity. The link opens a real authorization flow, but the application requesting access is controlled by the attacker.

The permission language matters more than the application’s name or logo. Requests to read mail, access cloud files, maintain access while offline or act on a user’s behalf deserve close scrutiny.

What to do

• Independently confirm unexpected document or access requests with the apparent sender.
• Review the application publisher and every permission before approving.
• Remove unfamiliar connected applications from the account’s security settings.
• Preserve messages and screenshots, then report suspected incidents to the relevant security team and the FBI’s IC3.

Changing a password alone may not revoke an application token. The connected application itself may need to be removed.