The request is the trap
In a September 1, 2026 advisory, the FBI describes attackers using messages and apparently useful invitations to steer targets toward a malicious application’s permission request. The provider’s authorization screen can be genuine. Approving the requested access can let the attacker’s app use account data without learning the password. [1]
Read what the app wants to do
Hypothetical example: Someone sends a link claiming to share a meeting agenda. The next screen asks an unfamiliar app for permission to read and send your email. The important mismatch is between the promised task and the requested access. This invented example does not identify a particular provider or current campaign.
A password reset is not the whole response
The FBI warns that changing the password does not, by itself, revoke the app authorization in the campaign it describes. It directs victims to remove the application’s access through account security settings and contact relevant security officials. Check the provider’s instructions for the affected account; do not assume a reset removed every connection. [1]
Go a little deeper
Optional reading · about 1 more minute
Separate the kinds of connection
Google’s account guide distinguishes using Google to sign in, granting an app access to account data, and linking accounts. It offers filters for reviewing these connections. That distinction helps identify what was actually authorized; this guide alone does not describe a complete incident-response procedure. [2]
Verify outside the invitation
The FBI recommends independently checking the sender and authorizing only trusted applications. Its advisory describes targeted activity observed since late 2025, not proof that every permission prompt is malicious or that multifactor authentication is useless. [1]
Original sources
Attributed synthesis, not original reporting. Examples labeled hypothetical or illustrative are explanatory. Reviewing a source does not independently validate its findings.
- FBI IC3: consent phishing advisory ↗
September 1, 2026 advisory read September 30; mechanism, persistence and mitigation paragraphs. Targeted campaign scope retained.
- Google Account Help: manage linked apps ↗
Undated provider guidance read September 30, 2026; three connection types and review filters. No account settings changed.