A password change may not stop consent phishing. Here is what the permission screen changes
A legitimate sign-in page can still be part of a deceptive request when the real action is granting a malicious app access.
Many phishing explanations teach people to look for a fake login page. Consent phishing creates a different problem: the sign-in and permission screen may belong to a real account provider, while the application requesting access is controlled by someone else.
In a September 1 advisory, the FBI said malicious actors had been targeting prominent people and their contacts through messages that impersonated journalists, academics, officials or event organizers. The link opened what looked like a file-sharing or identity-verification flow and ultimately asked the target to approve permissions for an application.
Why the screen can feel safe
The account provider may genuinely be handling authentication. The deception sits in the surrounding story and in the access being requested. An attacker does not necessarily need to learn the password if the target authorizes an app to read mail, access files or act on the account’s behalf.
That distinction changes recovery. Resetting a password is sensible after many account incidents, but an application token may remain valid until the connected application or permission is revoked.
Pause at the requested capability
Before approving, read the application name, publisher and each requested permission. Ask why a draft article, event invitation or shared document needs access to email, contacts or files. Open the account’s connected-app settings from a known route instead of continuing through the message.
If approval already happened, revoke the unfamiliar application, review recent account activity and sent mail, inspect forwarding and recovery settings, and notify contacts if the account may have sent messages on your behalf.
Primary source: FBI IC3, “Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing,” September 1, 2026 ↗