ConsentFix and ClickFix steal Microsoft 365 tokens via OAuth prompts
Source headline: ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds
Intelligence Summary
ConsentFix and ClickFix are social-engineering techniques that hijack Microsoft 365 sessions. The scams use deceptive consent prompts and OAuth flows to trick users into granting token access. Once the attacker gains the authorization, they can impersonate the victim in Microsoft 365. The risk includes mailbox access, document access, and account takeover without needing a typical MFA bypass. Microsoft 365 admins and users should scrutinize consent prompts, review OAuth app permissions, and monitor for suspicious token activity.
Recommended Action
Inventory where Microsoft 365 runs in your environment and treat this as an active remediation item. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.