By Hank Russell
The Federal Bureau of Investigation (FBI) is alerting high-net-worth individuals of a phishing scam in which bad actors use malicious links to access the victims’ personal information.
Since late 2025, malicious cyber actors have been targeting prominent victims, their family members, and personal acquaintances by directly messaging personal accounts with malicious links leveraging a technique known as “OAuth consent phishing.”
Recently observed activity includes impersonating government officials, media, and other publicly known personalities on a commercial messaging application (CMA) and soliciting the targeted individual to access a malicious link under the guise of a file sharing service through an application under the malicious actor’s control.
Previous phishing campaigns have also impersonated event coordinators and planners, who sent malicious links to targets under the guise of an invitation to an event and the need to verify the target’s identity through a malicious application under the actor’s control.
Ed Eisenstein, the CEO of United Network Associates in Farmingdale, said the FBI alert shows that multifactor authentication (MFA) is not enough to protect oneself from vicious cyberattacks and this is a topic that the cybersecurity community has been addressing for a while.
“What is concerning me again is that this is not a new concept,” he said. “The cybersecurity industry has been warning about identity-based attacks, OAuth abuse and cloud account compromise for years now. Many organizations are still not paying enough attention to the cloud identity layer because they believe MFA, strong passwords and endpoint protection are sufficient. They are not.”
Eisenstein said organizations “need to start treating cloud identity security with the same urgency they have traditionally given firewalls, endpoints and antivirus [software].”
Mitigation strategies include increased scrutiny of communications from unfamiliar phone numbers or accounts that are not part of a known contact list. Additionally, to prevent becoming a victim. Individuals should independently verify the identity of the sender and only grant authorization to trusted applications.
“In some cases, simply changing the user’s password does not remove that access,” Eisenstein said. “Cybersecurity is far more today then protecting passwords and computers. We now have to protect the identities, permissions and cloud access behind them.”
Anyone who believes that they may have been the victim of the phishing campaign described above is asked to contact their relevant security officials. The FBI requests that victims also report any incident to their local FBI Field Office or the Internet Crime Complaint Center (IC3) at http://www.ic3.gov. Victims are asked to report any information that is elicited and maintain screenshots of messages.