Article
How the scheme works
On September 1 the FBI issued a public service announcement on OAuth consent phishing, a technique it says has been in use since late 2025. The attacker sends a direct message with a link. The link opens a real sign-in and permission screen from a major email or cloud provider, so nothing looks wrong. When the user clicks to approve, they grant a malicious application ongoing rights to read and send email and open files.
The access does not rely on the victim’s password or second factor. Changing the password does not end it. The only fix is to remove the application or revoke its token in the account’s security settings. The FBI says recent waves impersonated government officials, journalists and other public figures, and earlier ones posed as event planners. Targets have been prominent people and those close to them, which in a health system includes executives, board members and their assistants.
Why it matters for hospitals
Most systems now run on cloud email and file sharing, and many still let staff approve third-party apps on their own. A single approved app on a senior leader’s mailbox can expose contract talks, payer negotiations, or patient information forwarded for review. It can also be used to send convincing payment-change requests to vendors.
A National Security Agency cyber hygiene guide posted September 3 points the same direction. Its first steps are basic: keep an inventory of what is on the network, use multifactor authentication and patch promptly. Over time it calls for zero trust practices, where no user or device is assumed safe, along with network segmentation and continuous monitoring.
Questions to put to IT this month
- Who can approve apps? Ask whether user consent to third-party applications is restricted, and whether high-risk permissions require administrator review.
- What is already connected? Request a review of applications with mail and file access on executive and board accounts, and remove anything unrecognized.
- Does incident response cover tokens? Confirm that playbooks revoke app grants and sessions, not just reset passwords.
- Are leaders trained? Brief executives and board members on verifying unexpected messages through a second channel before clicking.
Archive entry for Sep 12, 2026, added Nov. 11, 2026.
Sources
- Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (FBI IC3, Sep 1, 2026)
- FBI warns of cyber actors deceiving individuals through ‘OAuth consent phishing’ (AHA News, Sep 9, 2026)
- NSA releases best practices guide on cyber hygiene for defending against advanced threats (AHA News, Sep 10, 2026)