"Click this file link" lets a stranger read all your email — without stealing your password
A DM impersonating a journalist, official, or contact sends a "file-sharing link." Clicking opens a real Google OAuth screen. Clicking Allow grants the attacker read/write access to your email — access that survives a password change and MFA reset.
Also known as: OAuth consent phishing Canada, app permission phishing Gmail, consent phishing attack Canada, malicious OAuth grant Google, click allow email hack Canada
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Go to myaccount.google.com → Security → Third-party apps with account access and revoke any app you did not intentionally authorize
- 2 For Microsoft: visit myapps.microsoft.com and remove unfamiliar app authorizations
- 3 Before clicking Allow on any OAuth permissions screen, read carefully what the app is asking for — legitimate file-sharing services do not request permission to send emails or delete files
- 4 Treat any unsolicited file-sharing DM — even from a name you recognize — with the same caution as an email attachment from a stranger
- 5 After revoking the app, review your Sent folder and any shared documents for activity you did not initiate
- 6 Report to the Canadian Anti-Fraud Centre at https://antifraudcentre-centreantifraude.ca or call 1-888-495-8501.
Red flags
- ⚠ An unsolicited DM or email from someone impersonating a journalist, government contact, or known colleague asks you to open a file link
- ⚠ The link opens a real Google or Microsoft login or permissions consent screen asking to access your email, calendar, or files
- ⚠ You cannot explain why an unfamiliar app appears in your Google account's authorized apps list
- ⚠ Contacts report receiving file-sharing messages from your account that you did not send
- ⚠ You see sent emails or calendar events you did not create
- ⚠ Changing your password does not stop the unusual activity — because no password was stolen, only an app permission was granted
Sources
- FBI IC3 — PSA260901: Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (Sep 1, 2026)
- Help Net Security — Attackers target prominent individuals via OAuth consent phishing, FBI warns (Sep 2, 2026)
- Emerging-signals triage — Google OAuth phishing on Supabase/Pages.dev/Vercel (Nov 1, 2026)
- Emerging-signals triage — 3 active Google OAuth phishing clusters (pages.dev /api/auth, google-verify-portal.com, .org /backend/auth) — 13 signals total (Nov 2, 2026)
- Emerging-signals triage Nov 3, 2026 — 11 Google OAuth phishing signals across two clusters: tryadgence.com /auth/google (7 signals) and pages.dev /api/auth (4 signals); consecutive daily appearances confirm sustained campaign
- Emerging-signals triage Nov 4, 2026 — 15 Google OAuth phishing signals across 4 TLD clusters; 5 RBC-branded signals (CA country hint) confirming smishing-to-fake-portal active; campaign ongoing for 4+ consecutive days