SecurityHeroblog
Security Basics19views

FBI Warning — Your Password Never Left, but Your Inbox Is Open

You clicked a link, a real Google sign-in page appeared, and after signing in you pressed a blue 'Allow' button once. This is the technique the FBI's IC3 warned about on September 1. The password never reaches the attacker, yet mail and files keep leaking out.

Picture the digital lock on your front door. Some homes use just one code, but modern locks let you register several. You make a guest code for the person who cleans, and another one for your parents.

Here is what matters. Creating a guest code is not being robbed. You registered it yourself. And later, even if you change your own code, the guest code you registered stays alive. To get rid of it you have to open the lock and delete that code directly from the list of registered codes.

Today’s story is about the same thing happening to your account.

What Happens — All That Appears on Screen Is One Blue Button

FACT The FBI’s Internet Crime Complaint Center (IC3) issued an advisory on September 1, 2026. It says attackers are taking over accounts by getting victims to approve account access themselves.

FACT The sequence goes like this. A link arrives over a messaging app. It comes with something like “please check this document” or “just verify your identity.” It’s dressed up to look like a file-sharing service or an identity verification service. Click the link and you’re taken to a genuine Microsoft or Google sign-in page. Not a fake screen. The address bar is real too.

FACT Once you finish signing in, one more window appears. Something like “Will you allow ○○ Document Storage to read and write your mail?” alongside a blue button. Press allow here, and the attacker’s app keeps accessing your mail and files to the extent you approved. And yet the password never reaches the attacker.

INFERRED Put back in door-lock terms: nobody figured out your code. You registered one more guest code yourself. Someone asked at the door, “may I add a new code?” and you pressed confirm.

Why It Works — It Leaves Nothing to Be Suspicious Of

When we think phishing, we usually think of things like this: the address looks off, the screen looks somehow tacky, the wording reads awkwardly. Every check we’ve been taught asks “is this screen real?”

FACT But in this technique the sign-in screen is real. The password really is entered into the company’s own server. So there’s no wrong-password error, and no warning email about a sign-in from an unfamiliar place. It happens in exactly the spot where none of the checks we know will catch anything.

INFERRED What the attacker went after is not the skill of picking a lock but the owner’s confirm button. A door lock doesn’t commit theft when it registers a guest code either. It just waits for the owner to press.

INFERRED That’s what makes it hard to notice. There is effectively just one place you can check: the ‘apps connected to my account’ list in your account security settings. It’s the equivalent of the lock’s list of registered codes. If a name you never installed is sitting there, that’s what’s reading your mail right now.

Does Changing Your Password End It? — Read This Part Carefully

INFERRED This passage has a different degree of confirmation. That it bypasses both the password and multi-factor authentication (a step beyond the password, like a code sent to your phone), and that changing the password does not cut off access, so you have to revoke that app’s permission directly in account settings — this came from the security outlet Help Net Security. We could not confirm the same statement in the original FBI advisory. So we record it not as a “confirmed fact” but as “what was reported.”

INFERRED That said, it is a story that makes sense from the structure alone. Changing your own door-lock code doesn’t erase the guest code already registered. It’s gone only when you delete it from the list of codes.

FACT That the activity has been continuing since late 2025 was also reported as something the FBI stated. This too is a passage carried in the article.

How Big Is It? — There Are No Numbers

FACT Here’s something we have to be honest about. The advisory contains neither a victim count nor a loss figure. So not a single number indicating scale appears in this post. Instead of pulling in a number seen somewhere else and attaching it, we decided to write that what isn’t there isn’t there.

FACT What the FBI did tell us instead is the targets. The current targets are known figures in fields like media, academia, and politics, along with their families and acquaintances. Attackers impersonate government officials, reporters, or event organizers and open a conversation over commercial messaging apps.

INFERRED Reading this as “I’m not famous, so it doesn’t concern me” is only half right. Targets and technique are separate matters. The FBI said who is being aimed at right now, but the technique itself sits in a place where it works just the same for anyone using a Google or Microsoft account. Even so, saying “anyone and everyone is being hit en masse right now” would be an overstatement. The brief holds no such basis.

What to Do Now — It Takes Five Minutes

This post wasn’t written to frighten anyone. There are only two things you can do today, and neither is hard.

1. Open the list of registered codes. In the security settings of your Google account and your Microsoft account, open the ‘third-party apps’ or ‘connected apps’ list. If there’s an app you don’t remember, a name you never installed, just remove its access. It’s the same as deleting an unknown code from a door lock.

2. Verify links through a different channel. For a document link sent by a number or account you don’t know, check with the sender first through a different route, like a phone call. And if a permission request window appears after signing in — this is the real fork in the road — read the requested items once, and press cancel instead of allow. The FBI’s recommendation says the same thing. Be more suspicious of contact you don’t know, verify the sender’s identity directly, and grant permissions only to apps you trust.

INFERRED You only need to change one habit. You’ve already learned how to be suspicious of the sign-in screen, so now read the screen that appears after signing in once. Because it’s the window that asks, after the door is open, “shall I register one more code?”

What We Don’t Know

This blog writes down what it doesn’t know as not known. Here is what remains unconfirmed in this case.

  • Victim count and scale of damage. There are no figures in the advisory. So there are none in this post.
  • The actor behind it. The FBI did not name a country or organization. Neither do we infer one.
  • The name of the messaging app used for impersonation. Not disclosed. We do not name a specific app.
  • The malicious app’s name and the wording of its permission list. Not disclosed. So we cannot give you a list along the lines of “if you see this name, it’s dangerous.”
  • Domestic cases. No cases of damage to Korean users, or cases targeting Naver or Kakao accounts, have been confirmed.
  • The scope of targeting. The FBI’s description is “centered on known figures.” The range where the technique works and the range actually being aimed at are separate matters, and we have not mixed the two.

One more thing. The sentence in this post that sounds most practical — “changing your password doesn’t cut it off” — comes from reporting, not from the original FBI advisory. We wrote it once above, and we write it again here.

Sources

Primary sources first.

We opened the original FBI advisory directly to confirm the attack sequence, the targets, and the recommendations, and cross-checked it against the Help Net Security article. There was no place where the two accounts diverged. However, the passage about access not being cut off by a password change was not confirmed in the original summary, so we marked it as reported content. One article from another outlet was inaccessible and could not be cross-checked.

This post was written from the brief as of 2026-09-08. Because the material is public advisories and reporting rather than our own honeypot observations, we did not include timeline, MITRE, or IOC blocks, nor masked IPs or credential quotes — because we do not have that material. We did not use figures absent from the brief, and we marked the distinction between confirmed and reported only at the paragraph level. We do not carry procedures or addresses that would let anyone reproduce the attack.