[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYC1HiQ5-l2At_w13Dn_2TN11tgpLMsxVQJ7pxagla_s":3},{"article":4,"iocs":45,"watch_terms":52,"solutions":53,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"10931302-ded1-4a90-8b31-d56113ef6fa9","ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds","consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds-0f7346","ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA bypass tactics work and how to defend against them. [...]","ConsentFix and ClickFix are new attack techniques that hijack Microsoft 365 accounts by stealing OAuth tokens in seconds. ClickFix tricks users into executing commands via fake prompts, while ConsentFix exploits OAuth consent flows by having users drag a localhost callback link into their browser, unknowingly surrendering session tokens. These methods bypass traditional security awareness training and MFA, with detailed attack blueprints being shared openly on cybercrime forums.","ConsentFix and ClickFix attacks steal Microsoft 365 tokens via fake prompts and OAuth flows.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fconsentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F06\u002F30\u002Fclickfix-header-s.jpg","2026-07-02T14:00:10+00:00","2026-07-02T16:00:17.258641+00:00",9,[17,20,23,25],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":22},"OAuth","technology",{"name":24,"type":19},"Dropbox",{"name":26,"type":19},"DocSend","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":27,"icon":29,"name":30,"slug":31},null,"Identity & Access","identity-access",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,49],{"type":39,"value":47,"context":48},"ConsentFix","Attack technique targeting Microsoft 365 OAuth consent flows.",{"type":39,"value":50,"context":51},"ClickFix","Attack technique tricking users into executing commands via fake prompts.",[18,24,26],{"controls":54,"vendors":136},[55,84,110],{"slug":56,"name":57,"problem":58,"products":59},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":85,"name":86,"problem":87,"products":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[89,94,102],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":90,"product_name":91,"url":92,"description":93},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":111,"name":112,"problem":113,"products":114},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[115,120,128],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":116,"product_name":117,"url":118,"description":119},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[137],{"slug":77,"name":78,"logo_path":79,"roles":138},[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"oauth-token-hijacking-bypasses-mfa-in-microsoft-365-attacks","OAuth Token Hijacking Bypasses MFA in Microsoft 365 Attacks","ConsentFix and ClickFix represent a new generation of social engineering attacks that exploit OAuth consent flows and user-executed commands to steal session tokens, effectively rendering MFA irrelevant once a token is surrendered. The root problem is that users are manipulated into voluntarily granting access — through drag-and-drop UI tricks or fake browser prompts — meaning no credential is ever stolen in the traditional sense. Organizations relying solely on MFA and standard security awareness training have a dangerous blind spot here, as these attacks operate entirely within legitimate authentication flows. The open sharing of detailed attack blueprints on cybercrime forums means threat actor skill barriers are extremely low, dramatically increasing the likelihood of widespread exploitation.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-63B: Digital Identity Guidelines (Token Assurance)","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST SI-3: Malicious Code Protection","NIST IA-5: Authenticator Management","OAuth 2.0 Security Best Current Practice (RFC 9700)","Microsoft SSPA: Secure Supply Chain and OAuth App Governance","GDPR Article 32: Security of Processing (protecting access to personal data)",{}]