OAuth and BitB phishing campaigns

Cybersecurity researchers and the FBI have identified sophisticated phishing campaigns targeting enterprise accounts and individuals through OAuth consent and Browser-in-the-Browser (BitB) techniques.

Initial reports highlighted recruitment-themed campaigns where attackers impersonate HR employees from major corporations like Amazon, Apple, and Boeing. These attackers utilize BitB attacks to create simulated browser windows that trick users into providing credentials. Mobile users are especially at risk as the BitB frame can adapt into a full-screen counterfeit login page that hides URL indicators.

Subsequent warnings from the FBI clarified that OAuth consent phishing allows criminals to bypass traditional password theft. Instead of stealing passwords, attackers trick users into authorizing malicious applications. By clicking ‘Allow’ or ‘Accept’ on a deceptive prompt, users grant attackers permission to read emails and access files, providing persistent access to the account without the need for a password. In these instances, attackers may impersonate government officials or media representatives to initiate contact via messaging apps.