ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

ConsentFix and ClickFix represent a new generation of social engineering attacks that exploit OAuth consent flows and user-executed commands to steal session tokens, effectively rendering MFA irrelevant once a token is surrendered. The root problem is that users are manipulated into voluntarily granting access — through drag-and-drop UI tricks or fake browser prompts — meaning no credential is ever stolen in the traditional sense. Organizations relying solely on MFA and standard security awareness training have a dangerous blind spot here, as these attacks operate entirely within legitimate authentication flows. The open sharing of detailed attack blueprints on cybercrime forums means threat actor skill barriers are extremely low, dramatically increasing the likelihood of widespread exploitation.