ConsentFix: hijacking Microsoft 365 through the OAuth consent flow

ClickFix works by showing a fake verification prompt and persuading the victim to run a command on their own machine. ConsentFix keeps the psychology and changes the target: rather than executing code, it hijacks the OAuth consent flow that users complete without reading.

The lure typically sits on a trusted host such as Dropbox. The victim sees a convincing Microsoft authentication screen and is asked to drag a localhost callback link into their browser. That drag is the whole attack. It hands the attacker the OAuth tokens, and with them session access to mail and the rest of Microsoft 365.

No password is entered and no MFA prompt is defeated, because authentication already happened legitimately. The attacker simply takes the token it produced.

Why it matters

This is the failure mode that keeps catching organisations who believe MFA closed the question. Token theft operates after authentication, so the strength of the authenticator is irrelevant: a phishing-resistant sign-in produces a bearer token exactly like a weak one, and whoever holds it is the user.

The defensive centre of gravity therefore moves from login to session. Watch for new sessions appearing from unexpected locations, alert on unusual PowerShell, and bind sessions to a device where your platform supports it. Then look at your OAuth app governance, because the same consent screen is a standing invitation: users approve application permissions routinely and almost never read the scopes. Restricting who can consent to third-party applications takes an afternoon and removes most of this class. When a host is compromised, revoke tokens rather than only resetting passwords, or the attacker keeps the session you just paid to protect.

Source: BleepingComputer