ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

1. Executive summary

A new attack variant dubbed "ConsentFix" is being actively deployed against Microsoft 365 users, combining social engineering with OAuth consent-flow abuse to steal session tokens without requiring password entry or MFA bypass. The technique — alongside the related "ClickFix" methodology — has been documented with working code, infrastructure screenshots, and video tutorials posted to a public Russian cybercrime forum by early March 2026, significantly lowering the barrier to entry for threat actors. No verified reference data (CVSS scores, CISA-KEV states, or MITRE actor profiles) has been resolved for this item; attribution beyond "cybercriminal actors" is unconfirmed. EMEA financial services organisations using Microsoft 365 for email, collaboration, and document storage face account-takeover risk that bypasses traditional MFA controls and may not be detected by conventional phishing-detection tooling.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain — ConsentFix variant

1. Initial lure delivery. A phishing message is delivered to the target, often via trusted platforms such as Dropbox or DocSend. Some lures are placed behind a password, which also impedes automated security inspection of the link content.
2. Target profiling. Before sending the lure, attackers use LinkedIn and similar open-source intelligence tools to map the target organisation and tailor the lure to specific individuals.
3. Victict clicks through. The victim clicks the link and encounters what appears to be a standard Microsoft authentication screen.
4. Drag-and-drop trap. The victim is instructed to complete the authentication by dragging a localhost callback link into the browser address bar. This is the core ConsentFix mechanic — the drag-and-drop action surrenders OAuth tokens rather than completing a legitimate auth flow.
5. Token theft. The attacker receives OAuth access and refresh tokens tied to the victim's Microsoft 365 account. The victim never types credentials into a fake form; the session itself is what is stolen.
6. Persistent access. With valid refresh tokens, attackers maintain long-term access until tokens are revoked or expire, blending in with normal account activity.
7. Post-compromise activity. Attackers can read Outlook messages, send convincing emails from the victim's address (enabling further compromise of contacts), and access OneDrive, Teams, and other Microsoft 365 services without re-entering a password.

Attack chain — ClickFix variant (related, precursor technique)

1. Fake verification prompt. Victim is shown a fake prompt instructing them to press a sequence of keyboard shortcuts (e.g., a CAPTCHA-style or verification-style instruction).
2. Clipboard paste and execute. The keyboard shortcut sequence pastes and executes attacker-supplied commands on the victim's machine. No vulnerability is exploited; the user is socially engineered into running the payload.
3. ClickFix surged in 2025 and remains active. ConsentFix is the evolution of this concept, shifting the attack surface from local command execution to Microsoft 365 OAuth consent flows.

Attack chain — Kali365 PhaaS (related, corroborated by FBI warning)

1. Phishing message delivery. Victim receives a message that appears to come from a cloud service or collaboration tool (document-sharing notification, Teams invite).
2. Device code provided. The message includes a short "device code" and instructions: "Go to Microsoft's verification page and enter this code to view the document."
3. Legitimate Microsoft URL. The victim is directed to a real Microsoft URL used for device sign-in flows (https://microsoft.com/devicelogin or equivalent). The page looks familiar and legitimate.
4. Standard sign-in and consent screens. Victim sees standard Microsoft sign-in and consent screens, potentially including their organisation's branding. They believe they are completing a normal security check.
5. OAuth token issuance. Upon approval, the attacker's device receives OAuth access and refresh tokens tied to the victim's Microsoft 365 account.
6. Token reuse. Tokens can be reused to access Outlook, OneDrive, Teams, and other Microsoft services without re-entering a password. Refresh tokens enable long-term access until revoked or expired.

Technical specifics

• Exploit type: No CVE or software vulnerability is exploited. All three variants (ConsentFix, ClickFix, Kali365) abuse legitimate Microsoft OAuth flows and social engineering.
• Authentication mechanism abused: OAuth 2.0 device code flow (Kali365) and OAuth consent flow with localhost callback (ConsentFix).
• Token types stolen: OAuth access tokens and refresh tokens tied to Microsoft 365 accounts.
• MFA bypass mechanism: MFA is not technically bypassed — the victim completes MFA on the legitimate Microsoft page. The attacker receives the resulting session token, which encodes the completed authentication. This is a semantic distinction but important for detection: MFA logs will show successful authentication by the legitimate user.
• Delivery platforms observed: Dropbox, DocSend (ConsentFix); generic phishing messages (Kali365).
• Forum disclosure: By early March 2026, a detailed ConsentFix walkthrough was posted to a public Russian cybercrime forum, including working code, infrastructure screenshots, and a video tutorial. Infrastructure relied on free or widely available services.
• ClickFix fake prompt: Described as a "fake verification prompt" — no specific text strings, URLs, or file hashes are provided in the source material.

Confidence caveats

• The FBI warning on Kali365 is corroborated by both Malwarebytes Labs and BleepingComputer (multi-source). The Kali365 PhaaS platform and its device-code-flow abuse technique are well-documented.
• ConsentFix and ClickFix reporting is single-sourced to the BleepingComputer article. No independent corroboration of the ConsentFix drag-and-drop OAuth token-theft mechanic has been identified in the provided sources. Single-sourced; verify before enforcement.
• No MITRE ATT&CK actor profiles have been resolved for any named threat actor in this item. Attribution to "cybercriminal actors" operating from Russian cybercrime forums is unconfirmed beyond the forum post reference in the BleepingComputer article.
• No CISA-KEV entries, CVSS scores, or CVE identifiers are associated with this item. These are social-engineering-driven attacks abusing legitimate functionality, not software vulnerabilities.

4. Mitigation & containment

P1 — Within 24 hours

1. Review Microsoft 365 consent policies. Restrict third-party application consent in the tenant: - In Microsoft Entra ID (Azure AD), navigate to Enterprise applications > Consent and permissions > User consent settings. - Set user consent to "Do not allow user consent" or "Allow user consent for apps from verified publishers, for selected permissions" (requires admin review for other apps). - Configure the Consent and permissions policy to require admin consent for high-privilege OAuth scopes (Mail.Read, Mail.ReadWrite, Mail.Send, Files.Read.All, Files.ReadWrite.All, User.Read.All).
2. Block or restrict OAuth device code flow if not required by the organisation: - In Microsoft Entra ID, disable the device code flow at Authentication > User settings > "Users can sign in using the device code flow" — set to No if the organisation does not rely on device-code authentication.
3. Alert on anomalous OAuth consent grants. Create Microsoft Sentinel (or equivalent SIEM) detection rules for: - New OAuth app registrations or consent grants from non-corporate IP ranges. - Consent grants to applications with redirect URIs containing localhost or 127.0.0.1. - Multiple consent grants from a single user in a short time window.
4. User awareness communication. Issue an immediate advisory to all Microsoft 365 users: - Do not drag or paste any link into the browser address bar during authentication. - Do not enter device codes at microsoft.com/devicelogin unless personally initiated by IT. - Report any unexpected authentication prompts, especially those following document-sharing links from Dropbox or DocSend.

P2 — Within 72 hours

5. Conditional Access policy — token session controls. Configure Conditional Access policies to: - Require compliant device or hybrid Azure AD joined device for access to Exchange Online, SharePoint Online, and Microsoft Teams. - Limit session token lifetime to reduce the window of opportunity for stolen refresh tokens. - Block access from untrusted locations unless MFA is re-challenged.
6. Audit existing OAuth app consent grants. Run the following Microsoft Graph PowerShell to enumerate all consent grants: powershell Connect-MgGraph -Scopes "Directory.Read.All","AuditLog.Read.All" Get-MgServicePrincipal -All | Where-Object { $_.Oauth2PermissionGrants } | Select-Object DisplayName, AppId, Oauth2PermissionGrants Review and revoke any unrecognised or suspicious applications.
7. Monitor for suspicious email-sending patterns. Configure Microsoft Defender for Office 365 anomaly detection for: - Emails sent from compromised accounts to external recipients shortly after a new OAuth consent grant. - Inbox rules created by attackers to hide forwarded emails (common post-compromise behaviour).
8. EDR / endpoint detection rules. If ClickFix payloads are a concern, configure detection for: - Processes spawned from browser drag-and-drop or paste-and-execute actions (e.g., powershell.exe or cmd.exe with parent process of the user's browser). - Clipboard content containing script or command-line payloads.

P3 — Within 7 days

9. Tabletop exercise. Run a simulated ConsentFix attack against a test tenant to validate detection coverage and incident-response playbook. Document the OAuth token revocation procedure as a runbook.
10. Microsoft 365 audit log retention. Ensure Unified Audit Log (UAL) retention is set to maximum (180 days for E3, 1 year for E5/A5) to support post-incident investigation of OAuth consent grants and session activity.
11. Third-party platform review. Review whether Dropbox, DocSend, or similar file-sharing platforms used in the organisation can be configured to scan shared links for phishing content, or whether blocking these platforms for external file-sharing is warranted.

5. Indicators of compromise

No indicators of compromise available in the source material. The source articles do not provide specific file hashes, IP addresses, domains, URLs (beyond generic references to microsoft.com/devicelogin), OAuth application IDs, or other discrete IOC values. The attacks are social-engineering-driven and leverage legitimate Microsoft infrastructure, meaning traditional IOC-based detection is not effective for this threat.

6. Detection

The source material does not contain specific IOCs (file hashes, IP addresses, domains, OAuth app IDs, or distinctive command strings). However, the sources describe behavioural indicators that can be used for Sigma rule construction.

Sigma rule — OAuth consent grant to application with localhost redirect URI

title: OAuth Consent Grant to Application with Localhost Redirect URI
id: 7a3c2e1f-9b4d-4e8a-8f1c-2a3b4c5d6e7f
status: experimental
description: >
  Detects OAuth consent grants to applications that use localhost or 127.0.0.1
  as a redirect URI, consistent with the ConsentFix attack pattern described in
  BleepingComputer reporting. This may indicate a social-engineering-driven
  OAuth token theft attempt.
references:

  - https://www.bleepingcomputer.com/news/security/consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds/
author: Adverse Trace
date: 2026/07/02
logsource:
  product: microsoft
  service: auditlogs
detection:
  selection:
    operationName: "Consent to application"
    properties.redirectUri|contains:

      - "localhost"
      - "127.0.0.1"
  condition: selection
falsepositives:

  - Legitimate development or testing applications using localhost redirect URIs
  - Local development OAuth flows
level: high

Sigma rule — Device code flow authentication from non-corporate IP

title: Device Code Flow Authentication from Non-Corporate IP
id: 8b4d3f2e-0c5e-4f9b-9e2d-3b4c5d6e7f8a
status: experimental
description: >
  Detects device code flow authentication events originating from IP addresses
  outside the corporate IP range, consistent with the Kali365 PhaaS attack
  pattern where an attacker's device completes authentication using a code
  provided to the victim via phishing.
references:

  - https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/
  - https://www.malwarebytes.com/blog/scams/2026/05/kali365-phishing-kit-bypasses-mfa-and-steals-microsoft-logins
author: Adverse Trace
date: 2026/07/02
logsource:
  product: microsoft
  service: signinlogs
detection:
  selection:
    authenticationRequirement: "multiFactorAuthentication"
    clientAppUsed: "Device code flow"
  filter_corporate_ip:
    ipAddress|cidr:

      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
  condition: selection and not filter_corporate_ip
falsepositives:

  - Legitimate device code authentication from remote workers
  - IoT or non-browser device authentication
level: medium

Sigma rule — Suspicious process execution from browser (ClickFix pattern)

title: Suspicious Process Execution from Browser via Paste or Drag-Drop
id: 9c5e4d3f-1d6f-4e0a-af3e-4c5d6e7f8a9b
status: experimental
description: >
  Detects command-line interpreters (powershell.exe, cmd.exe) or script hosts
  spawned by browser processes, which may indicate ClickFix-style social
  engineering where a victim is tricked into pasting and executing attacker-
  supplied commands.
references:

  - https://www.bleepingcomputer.com/news/security/consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds/
author: Adverse Trace
date: 2026/07/02
logsource:
  product: windows
  service: security
detection:
  selection_process:
    Image|endswith:

      - "\\powershell.exe"
      - "\\cmd.exe"
      - "\\wscript.exe"
      - "\\cscript.exe"
      - "\\mshta.exe"
  selection_parent:
    ParentImage|endswith:

      - "\\chrome.exe"
      - "\\msedge.exe"
      - "\\firefox.exe"
      - "\\brave.exe"
  condition: selection_process and selection_parent
falsepositives:

  - Legitimate browser-launched applications or installers
  - Web-based development tools
level: medium

7. Sources

• BleepingComputer — ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds — https://www.bleepingcomputer.com/news/security/consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds/ — 2026-07-02
• Malwarebytes Labs — Kali365 phishing kit bypasses MFA and steals Microsoft logins — https://www.malwarebytes.com/blog/scams/2026/05/kali365-phishing-kit-bypasses-mfa-and-steals-microsoft-logins — 2026-05
• BleepingComputer — FBI warns of Kali365 phishing service targeting Microsoft 365 accounts — https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/ — 2026 (date not specified in source)
• BleepingComputer — Hackers target Microsoft 365 accounts with 81 million login attempts — https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-365-accounts-with-81-million-login-attempts/ — 2026 (date not specified in source; related context only)

8. Adverse Trace position

Severity assessment: Medium-to-high for EMEA financial services organisations using Microsoft 365. The attack bypasses MFA without exploiting a software vulnerability, meaning traditional patching and vulnerability management do not apply. Mitigation requires Microsoft 365 tenant configuration changes (OAuth consent policies, device code flow restrictions, Conditional Access) and user awareness — not endpoint patching. The publication of working code and tutorials on a public Russian cybercrime forum by early March 2026 indicates this is actively being operationalised by multiple threat actors with low technical skill barriers.

Client-impact assessment: Financial services clients are high-value targets for Microsoft 365 account takeover due to the volume of sensitive communications, regulatory documents, and internal collaboration data flowing through Exchange Online, SharePoint Online, and Teams. The ability for attackers to send convincing emails from a compromised executive's address creates secondary-phishing risk across the organisation and to external counterparties. The use of trusted delivery platforms (Dropbox, DocSend) for initial lure delivery may bypass email security gateways.

Confidence caveat: ConsentFix and ClickFix reporting is single-sourced to BleepingComputer. The Kali365 PhaaS reporting is multi-source (FBI, Malwarebytes, BleepingComputer). No verified reference data (CVSS, CISA-KEV, MITRE actor profiles) has been resolved. Attribution beyond "cybercriminal actors" is unconfirmed. Single-sourced elements should be verified before enforcement.

Next steps: Adverse Trace will monitor for independent corroboration of the ConsentFix drag-and-drop OAuth token-theft mechanic, track the referenced Russian cybercrime forum post for additional IOCs, and update this advisory if CISA, Microsoft, or other authoritative sources publish detection guidance or IOCs.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.