Most employees have learned to be suspicious when a website asks them to enter a password. A newer phishing technique takes a different approach.
Instead of stealing the password directly, the attacker tries to convince the employee to approve an unfamiliar application. The request may appear on a legitimate Microsoft or Google permission page and ask for access to email, files, contacts, or calendars.
The dangerous part is the familiar-looking Allow button.
On September 1, 2026, the FBI’s Internet Crime Complaint Center warned about this technique, known as OAuth consent phishing. The alert focuses on campaigns targeting prominent individuals and their acquaintances, but the method is relevant to any organization that uses cloud-based email and file-sharing services.
Many legitimate applications connect to Microsoft 365, Google Workspace, and other cloud services without receiving the user’s password.
For example, a scheduling application might request permission to view a calendar. A document tool might request access to selected files. The account provider gives the approved application a digital access pass, often called a token.
Consent phishing abuses that normal process.
An attacker creates an application that appears useful or familiar. The victim receives a message about a shared document, event invitation, identity check, or another plausible request. After following the link, the victim may land on a real cloud-provider login or permission page.
If the victim approves the requested permissions, the malicious application receives access. Depending on what was approved, it may be able to read email, send messages, or view files.
This attack is especially concerning because the employee may never give the attacker a password.
The FBI explains that access granted to the application can remain active until the application’s permission or token is revoked. Merely changing the account password may not remove it.
That means a business could reset the employee’s password, assume the problem is solved, and still leave the malicious application connected.
Multi-factor authentication remains important, but it cannot protect an account when the legitimate user signs in and deliberately approves the attacker’s application. The approval itself becomes the doorway.
An application-permission request deserves the same caution as a password request.
Employees should pause when:
A legitimate Microsoft or Google page does not automatically make the application requesting access trustworthy.
When an unexpected application asks for permission, employees should stop before selecting Allow.
Verify the request with the sender through a separate method. Call a known telephone number, start a new message using an address already in the company directory, or contact the organization through its official website.
Do not use the contact information included in the suspicious message.
Employees should also know how to send the request to the company’s IT provider. A quick review can be much less disruptive than investigating an account after access has been granted.
Employee awareness is only one part of the answer. Microsoft allows administrators to control when users can approve applications and which requests require administrative review.
A practical review should include:
Microsoft recommends limiting user consent to suitable applications from verified publishers. Existing approvals also need separate review because changing the policy does not automatically remove permissions already granted.
Contact your IT or security provider immediately. Do not rely only on a password change.
Record the message, sender, application name, requested permissions, and approximate time of the event. Preserve screenshots if possible.
The response may need to include removing the application’s consent, revoking active access, reviewing account activity, checking email rules and forwarding settings, and determining whether messages or files were accessed.
The FBI also asks victims to report relevant incidents to the Internet Crime Complaint Center. Businesses facing suspected financial fraud should promptly contact their financial institution through a verified number.
Small businesses do not need to prohibit every connected application. Cloud integrations can save time and improve operations. The goal is to ensure that employees are not making high-impact access decisions without enough information.
A short approval process, a controlled list of business applications, and regular reviews can make the difference between a useful integration and an unnoticed account compromise.
Himala and his team at Cybernetic Networks have been amazing. We have been a customer of Cybernetic Networks for well over 14 years now, both personally and professionally. Himala and his team are professional, reachable and on the cutting edge of technology. We have enjoyed doing business with Cybernetic Networks for many years and still rely on their knowledge, skills and technology every day
Himala and his Cybernetic team have never let me down! For over 10 years now they have been fixing my technical issues, set up all my new networks and computers and have safeguarded me from any hackers or malware. You can trust this company to navigate you as your company grows and to keep you on track with the latest in security and safety
I am a solo practicing neurologist and have had all my IT needs covered through Cybernetic Networks since 2007. They are the best! All of their tech support staff is extremely knowledgeable and efficient. Just as importantly, they are quickly responsive whenever we need their assistance. I couldn’t be happier with their service and give them my highest recommendation!
I couldn't be happier with Cybernetics - they are experts, always respond quickly , and solves any issues I have.
Cybernetic Networks has been advising and supporting all our IT issues and purchases for the last 18 years. They are very responsive and extremely knowledgeable- always providing us with timely services.
It is not often you find small business companies that are not only rewarding to work with, but also have integrity, truth and skill. I have worked with this company for over 20 years, and the service is outstanding. I can easily recommend that if you need an IT company, this is the one to get. Full STOP! Look no further, you will be happy that you did. Sue Myhelic, Gulf Breeze Real Estate, Naples, Florida.
Himala and his team from Cybernetic Networks, Inc. has been an integral part of our successful retail business for the past 20 years. He is extraordinarily knowledgable and always available for our IT needs. Thanks to Himala and his team we are always up and running.
