"Click this file link" message grants a stranger permanent access to your email — without your password
A DM impersonating a journalist, official, or known contact sends a file-sharing link. Clicking opens a real Google or Microsoft OAuth consent screen. Clicking Allow grants the attacker read/write access to your email and files — access that survives a password change and MFA reset.
Also known as: OAuth consent phishing, app permission phishing, consent phishing attack, malicious OAuth grant Australia, Google sign-in phishing
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Go to myaccount.google.com → Security → Third-party apps with account access and revoke any app you did not intentionally authorise
- 2 For Microsoft: visit myapps.microsoft.com and remove unfamiliar app authorisations
- 3 Before clicking Allow on any OAuth consent screen, read the list of permissions — legitimate file-sharing services do not need permission to send emails, delete files, or access your contacts
- 4 Treat any unsolicited file-sharing DM — even from a known name — with the same caution as an email attachment from a stranger
- 5 After revoking the rogue app, check your Sent folder and shared documents for activity you did not initiate
- 6 If you use Google Workspace for work, alert your IT administrator — the rogue app may retain access to company data
- 7 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.
Red flags
- ⚠ An unsolicited DM from someone impersonating a public figure, government contact, journalist, or recruiter asks you to open a file or sign in via a link
- ⚠ The link leads to a standard Google or Microsoft OAuth consent screen asking permission to read your email, files, or calendar
- ⚠ The hosting domain is a developer platform like supabase.co, pages.dev, or vercel.app — legitimate apps can use these, but phishing campaigns abuse them
- ⚠ You cannot explain why an unfamiliar app appears in your Google or Microsoft authorized applications list
- ⚠ Contacts report receiving file-sharing requests from your account that you did not initiate
- ⚠ Changing your password does not stop the unusual activity — because no password was stolen, only an OAuth grant was obtained
- ⚠ A gaming, competition, job portal, or AI-tool site asks you to sign in with Google to continue
Sources
- FBI IC3 PSA260901 — Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (Sep 1, 2026)
- Help Net Security — OAuth consent phishing lets hackers bypass passwords, FBI warns (Sep 2026)
- Emerging-signals triage — Google OAuth phishing clusters on Supabase/Cloudflare Pages/Vercel (Nov 1, 2026)
- Emerging-signals triage — 7 active Google OAuth /api/auth clusters on pages.dev (Nov 2, 2026)