A "document link" grants a stranger permanent access to your Gmail without stealing your password
A message impersonating a journalist, government contact, or colleague asks you to open a 'file link.' Clicking opens a real Google OAuth screen. Pressing Allow hands the attacker read and write access to your Gmail and Drive — access that survives a password change and 2-step verification reset.
Also known as: OAuth consent phishing, Google app permission scam, consent phishing attack India, malicious OAuth grant, file link phishing Gmail
Already happened to you? Do this in the next few minutes
Call 1930 now- 1 Call 1930 — the national cyber-crime helpline — right now. The sooner you report, the better the chance of freezing the money before it moves.
- 2 Call your bank to freeze the account and block the card immediately. Use the number printed on your card, never a number from the message or caller.
- 3 File a report at cybercrime.gov.in and keep every message, screenshot, and transaction ID.
What to do right now
- 1 Go to myaccount.google.com → Security → Third-party apps with account access and revoke any app you do not recognise or did not intentionally authorise
- 2 For Microsoft accounts: visit myapps.microsoft.com and remove unfamiliar app authorisations
- 3 Before clicking Allow on any OAuth consent screen, read the full permission list — a document viewer never needs permission to send emails or delete files
- 4 Treat any unsolicited file-sharing link — even from a contact's account — with the same caution as an APK from an unknown number
- 5 After revoking the rogue app, review your Sent folder and any Drive shared documents for activity you did not initiate
- 6 Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).
Red flags
- ⚠ An unsolicited message on WhatsApp, Telegram, LinkedIn, or email from someone impersonating a journalist, academic, government official, or known contact shares a 'document link'
- ⚠ Clicking the link opens a real Google or Microsoft login and then an OAuth consent screen listing permissions like 'Read your email' or 'Send email on your behalf'
- ⚠ You cannot explain why an unfamiliar app name appears in your Google Account → Security → Third-party apps list
- ⚠ Contacts report receiving messages or files from your account that you never sent
- ⚠ Changing your password or resetting 2-step verification does not stop unusual account activity — because no password was stolen
Sources
- FBI IC3 — PSA260901: Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (Sep 1, 2026)
- Help Net Security — Attackers are going after prominent individuals through OAuth phishing, FBI warns (Sep 2, 2026)
- Emerging-signals triage — Google OAuth phishing cluster on .pages.dev and Vercel domains (Nov 2, 2026)