For islanded AC microgrids under bounded and time-varying false data injection (FDI) attacks on actuators and communication links, a resilient distributed secondary control strategy is proposed to stabilize frequency and voltage at the reference values, and to achieve the optimal active power sharing. To mitigate the impact of FDI attacks on the stability of the islanded microgrid, extended-state observers are introduced to estimate the impact. Compared with the currently presented resilient distributed control strategies, which ensure the bounded stability of microgrids, the control objective that the synchronization of every distributed generator’s voltage and frequency to the reference values and the achievement of the optimal active power sharing is maintained by the proposed resilient control strategy. An example of an islanded AC microgrid is given to verify the proposed method.