A "file link" takes you to a real Google or Microsoft permissions screen — clicking Allow hands the attacker permanent access to your account
A DM posing as a colleague sends a "file link." Clicking opens a real Google or Microsoft OAuth screen. Clicking Allow grants the attacker persistent access to your email — access that survives a password change and MFA reset.
Also known as: OAuth consent phishing UK, app permission phishing UK, fake file link Google permissions scam, consent phishing attack UK, malicious OAuth grant UK
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Go to myaccount.google.com → Security → Third-party apps with account access and revoke any app you did not intentionally authorise
- 2 For Microsoft accounts: visit myapps.microsoft.com and remove any unfamiliar app authorisations; also check Azure AD enterprise app consents if you use a workplace account
- 3 Before clicking Allow on any OAuth consent screen, read the listed permissions carefully — if an app claims to need permission to send email, delete items, or access contacts, close the screen immediately
- 4 Never open file-sharing links sent in unexpected DMs, even from apparent colleagues or officials — verify through a separate, known channel first
- 5 After revoking a rogue app, review your Sent folder and shared documents for activity you did not initiate; check inbox rules for any forwarding rules added without your knowledge
- 6 If you disclosed banking details or the attacker used account access to initiate transactions, contact your bank immediately
- 7 Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.
Red flags
- ⚠ An unsolicited DM — on WhatsApp, LinkedIn, X, or email — from someone posing as a journalist, colleague, official, or NCSC contact asks you to open a shared file or document
- ⚠ Clicking the link opens a genuine Google or Microsoft OAuth consent screen showing the provider's real branding — the URL is legitimate, but the app requesting permission is malicious
- ⚠ The permissions list includes read or send access to your email, calendar, or files — legitimate file-sharing services do not need to send emails on your behalf
- ⚠ You see an unfamiliar app in your Google account security settings or Microsoft My Apps that you did not intentionally install
- ⚠ Contacts report receiving messages from your account that you did not send, or you find calendar events you did not create
- ⚠ Changing your password has no effect on the unusual activity — because no password was stolen; an app token was granted
Sources
- FBI IC3 PSA260901 — Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (September 1, 2026)
- Help Net Security — Attackers are going after prominent individuals through OAuth phishing, FBI warns (September 2, 2026)
- Emerging-signals triage — 2 active Google OAuth phishing clusters detected (November 1, 2026)
- Emerging-signals triage — 4 active Google OAuth phishing clusters on pages.dev and .dev domains (November 3, 2026)
- Emerging-signals triage — 8 active Google OAuth consent phishing signals on 4 November 2026; campaign ongoing with .com/auth/google path shape
- TechRadar — Clicking Allow on a real Google or Microsoft screen can give hackers full account access, FBI warns (September 2026)