The FBI's Internet Crime Complaint Center published PSA I-090126 on September 1, 2026, and it describes an attack that quietly defeats the two things most people rely on: changing your password, and having multi-factor authentication turned on.
Neither one helps here. That is not a flaw in either — it is that this attack never touches your password at all.
What consent phishing actually is
You have almost certainly done the legitimate version of this. You sign into some service with “Continue with Google,” a permission screen appears listing what the app wants — read your email, see your files, post on your behalf — and you click Allow. That grant is an OAuth token. It is how a scheduling tool reads your calendar without ever knowing your password.
Consent phishing is the same flow with a hostile app at the end of it. The attacker registers a real application with a real provider, requests broad permissions, and sends you a link. You land on a genuine login page — the actual Google or Microsoft one, correct domain, valid certificate — and authenticate normally. Then the permission screen appears, and if you approve it, the attacker holds a token that reads your mail and files whenever it likes.
