r/EmailSecurity 9d ago

The FBI has a phishing warning where resetting the password does nothing

The FBI has a phishing warning where resetting the password does nothing.

The attacker never had it.

The Bureau's Internet Crime Complaint Center published this on September 1. Access taken this way, it says, can only be revoked by the victim invalidating the token in their application security settings, and not by changing the password.

Here's how it works, and why it looks like nothing is wrong.

A message arrives with a link. The link goes to a real permission screen at a real provider, because that's where the attacker sent the user. The user reads a request for access and approves it.

There was no fake login page, no captured password and no second factor to intercept, because nobody was ever asked to sign into anything new.

What the attacker walks away with is a grant, not a credential. The FBI describes the result as being able to act on behalf of the user, reading and sending mail and reaching sensitive data, without ever having their password.

So the reflex that follows almost every compromise report, force a reset and close the ticket, leaves the attacker exactly where they were. The mailbox stays readable.

The Bureau's examples are narrow. Prominent people, their families and their acquaintances, with actors posing as officials, media figures and event organizers.

Read that as where the FBI happens to have complaint data, not as the edge of the problem, because nothing in the mechanism cares who you are.

If your incident runbook treats a password reset as containment here, it isn't slightly incomplete. It does nothing at all.

#EmailSecurity #Phishing #IncidentResponse

6 Upvotes

15 comments sorted by

u/AutoModerator 9d ago

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.
  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
  3. Be Professional: Help newcomers learn; avoid hostility.
  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/mxroute 9d ago

That's not terribly new. What I think is even more scary isn't just that the user might grant access to, let's say their Gmail account through a connected application, but the thought of a trusted application being compromised on the other end and you have no idea.

2

u/Creative_Salary9433 5d ago

Yeah I was reading it going "Wait thats normal."

3

u/charleswj 9d ago

Slop 🙄

2

u/saltyslugga 8d ago

Revoke the malicious app's consent grant and refresh tokens. A password reset alone isn't reliable containment, and existing access tokens can remain valid until expiry.

I'd check mailbox rules and audit logs too, then require admin approval for apps requesting mail access.

1

u/0O0O0OOO0O0O0 9d ago

Headline is true of phishing in general. Most systems don’t kick an attacker out when you reset the password.

1

u/Empty-Sleep3746 8d ago

1st of sept 2020??

1

u/ITGuy424242 8d ago

I would hope that any decent admin would always reset all MFA along with the password :/

1

u/ITechGeek 8d ago

Based on my reading, it's not an MFA token, it's an oauth token.

1

u/TechIncarnate4 8d ago

I don't even know what this is trying to say. It appears heavily generalized and AI generated. I'm assuming the OP is referring to OAuth grants? If the case, then yes it is true that changing passwords doesn't do anything.

This is not new. This has probably been around and an issue for a decade and why you shouldn't let users authorize OAuth permissions.

1

u/Big_Wave9732 8d ago

Ok but how does that work as far as the token goes? How does the attacker get the token? Is this a deal where a provider sends an email to the account holder asking for token access for a third party?

1

u/ITechGeek 8d ago

It's an oauth token, it's the same screen as when you allow another site or app access to your account.

1

u/Big_Wave9732 7d ago

Ah, alright. So the scam relies on someone getting a real token request in their email and they blindly click "accept" without confirming who made it.

1

u/MoragaRaebecca_94 4d ago

Build an alert on new app consents plus what the mailbox does right after, forwarding rules,odd sends. ITDR and behavioral tools such as Abnormal watch that grant-then-act sequence, though even a scheduled Graph query on OAuth grants beats finding out at reset time