# ConsentFix and ClickFix: The 3-Second Microsoft 365 Account Hijacking You Can't See Coming


A new class of OAuth-based attacks is bypassing multi-factor authentication (MFA) on Microsoft 365 accounts in as little as three seconds. Security researchers have identified two related attack vectors—ConsentFix and ClickFix—that exploit the trust relationship between Microsoft's OAuth implementation and enterprise authentication flows, allowing attackers to steal and use valid authentication tokens without triggering traditional security controls.


Unlike credential theft or brute-force attacks, these techniques operate within the bounds of legitimate OAuth protocol behavior, making them extraordinarily difficult to detect and defend against using conventional endpoint security tools.


## The Threat: A New Dimension of Account Compromise


ConsentFix and ClickFix attacks represent a departure from traditional credential harvesting. Rather than stealing usernames and passwords, attackers target the OAuth token itself—the digital proof of identity that grants access to Microsoft 365 services including Outlook, SharePoint, OneDrive, and Teams.


The attack works in three stages:


1. Initial Access: Attackers send a phishing email containing a malicious link that directs the victim to a fake Microsoft login or OAuth consent screen

2. Silent Token Theft: The victim's browser completes an OAuth flow that appears legitimate, unaware that their authentication token is being captured by the attacker

3. Account Takeover: With the token in hand, the attacker can access the victim's Microsoft 365 account, bypass MFA entirely, and operate with full account permissions


The most alarming aspect: the entire process takes approximately 3 seconds from click to compromise, and the victim sees nothing unusual. No credential prompt. No MFA challenge. No anomalous sign-in notification.


## Background and Context: Why OAuth is Both Powerful and Vulnerable


OAuth 2.0 is the internet's standard for delegated access—it allows applications to request permission to access user data without ever handling passwords. Microsoft 365 relies heavily on OAuth for third-party integrations, external collaborations, and federated sign-in scenarios.


However, OAuth's flexibility creates an attack surface when users don't fully understand what permissions they're granting.


### The Evolution of Account Takeover Tactics


| Attack Type | Method | MFA Bypass? | Detection Difficulty |

|-------------|--------|------------|---------------------|

| Credential Theft | Phishing for username/password | No | Moderate |

| MFA Bypass (Traditional) | SIM swapping, MFA fatigue | Yes (device-based) | Low |

| Token Theft (ConsentFix/ClickFix) | Fake OAuth consent screen | Yes (MFA not invoked) | Very High |


The key difference: ConsentFix and ClickFix never ask for credentials or trigger MFA because they intercept the token *after* the user has already authenticated legitimately elsewhere (or appear to).


### How This Fits the Broader Threat Landscape


These attacks align with a broader trend of post-compromise persistence techniques used by advanced threat actors. Groups like APT28, Lazarus, and financially-motivated cybercriminals have invested heavily in OAuth and token-based attacks because:


  • MFA protects the authentication endpoint but not the token endpoint
  • Tokens persist for hours or days, allowing offline account access
  • Token theft leaves minimal forensic evidence compared to password spray attacks
  • OAuth is deeply integrated into enterprise authentication, making defenders reluctant to block it

    • ## Technical Details: How the Attacks Work


    ### ConsentFix: The Fake Consent Screen Attack


    In the ConsentFix variant, attackers create a replica of Microsoft's OAuth consent screen—the page that asks users to approve permissions for an application (e.g., "Allow app to read your email").


    Attack flow:


    1. Victim receives phishing email with link to attacker-controlled server

    2. Attacker's server performs an OAuth authorization request to Microsoft's servers, then redirects the victim to a fake consent screen that mimics Microsoft's design

    3. When the victim clicks "Accept," the attacker's server captures the authorization code returned by Microsoft

    4. The attacker exchanges this authorization code for a valid access token (OAuth tokens are valid for hours)

    5. Attacker uses the token to sign into the victim's Microsoft 365 account—MFA is bypassed because the token is already authenticated


    Why it works: Microsoft's OAuth implementation includes an expedited re-authentication flow for users who've already signed in to Microsoft services. If the victim is logged into Outlook.com or OneDrive, clicking the phishing link can silently re-authenticate without additional prompts.


    ### ClickFix: The One-Click Compromise


    ClickFix is a variant that reduces friction even further. Instead of mimicking a consent screen, the attacker's link directly initiates an OAuth flow with pre-configured parameters, requiring only a single click to complete.


    This variant is particularly dangerous in low-friction environments where users have multiple Microsoft services already signed in across browser tabs—a common scenario in corporate environments with federated identity.


    ## Why Traditional Defenses Fall Short


    ### MFA Doesn't Help


    This is critical: Conditional Access policies, push notification MFA, and hardware security keys do not stop ConsentFix/ClickFix attacks because MFA is only enforced at the *authentication stage*. Once a token is issued, MFA is irrelevant.


    ### EDR and Antivirus Are Blind


    Endpoint Detection and Response (EDR) tools see only the browser opening a tab and making an OAuth request. From the endpoint's perspective, this is legitimate user behavior. There is no malware execution, no suspicious registry modification, no process injection. The attack lives entirely within the OAuth protocol.


    ### Token-Based Detection is Sparse


    Most organizations lack visibility into:

  • Where tokens are being used
  • Which devices are consuming tokens
  • Geographic anomalies in token usage patterns
  • Unusual API calls made with a stolen token

    • ## Implications for Organizations


    ### Who's at Risk?


    All organizations using Microsoft 365 are at risk, but the threat is highest for:


  • Financial services and banking: High-value targets with access to payment systems and sensitive data
  • Healthcare organizations: Patient data and medical record access make accounts attractive targets
  • Law firms and consulting: Privileged access to confidential client data
  • Government and defense contractors: Access to restricted information and classified collaboration spaces
  • Any organization with high-permission service accounts: Shared mailboxes, resource accounts, and admin-level Microsoft 365 user accounts are prime targets

    • ### Business Impact Scenarios


    Once compromised, an attacker with a stolen token can:


  • Read all emails in the victim's mailbox (past and future)
  • Access shared files in OneDrive and SharePoint
  • Impersonate the user in Teams conversations and meetings
  • Forward all future emails to an external address
  • Plant business email compromise (BEC) attacks by impersonating the compromised user to colleagues
  • Establish persistence by creating forwarding rules and other configuration changes
  • Access connected applications like Power BI, Dynamics 365, and third-party SaaS apps integrated with Microsoft 365

    • ## Recommendations: Detection and Defense


    ### Immediate Actions


    1. Enable token binding (if available in your environment): Requires that OAuth tokens are bound to the device they were issued on, preventing cross-device reuse

    2. Review OAuth app permissions: Remove unnecessary third-party OAuth integrations from your tenant

    3. Implement Conditional Access policies for high-risk scenarios:

    - Block OAuth consent for applications not in an approved list

    - Flag and require re-authentication for API access patterns that deviate from baseline

    4. Monitor token usage logs: Enable Azure AD/Entra ID audit logging and search for:

    - Token issuance from unfamiliar geographic locations

    - Token usage on non-managed devices

    - Unusual API activity following token issuance


    ### Detection Strategies


  • Look for forwarding rules: OAuth token attacks often create mail forwarding rules. Regularly audit inbox rules across your organization
  • Monitor for abnormal Teams activity: Stolen tokens are frequently used to post messages in Teams channels or exfiltrate chat history
  • Track Conditional Access policy bypasses: If you see sign-ins that would normally trigger MFA but don't, investigate
  • Watch for suspicious third-party app grants: Review who has granted permissions to third-party OAuth apps, particularly if the grant timestamp is recent

    • ### Long-Term Mitigation


  • Transition to phishing-resistant MFA: Hardware security keys and Windows Hello for Business are not vulnerable to OAuth token interception
  • Implement device compliance requirements: Restrict OAuth token usage to managed, endpoint-protected devices
  • Adopt zero-trust principles: Assume tokens can be stolen; implement step-up authentication for sensitive operations (accessing shared mailboxes, modifying security settings)
  • Consider passwordless authentication: Move away from password + MFA models toward certificate-based or biometric authentication

    • ---


    ## HackWire Analysis


    ConsentFix and ClickFix represent a maturation of attack techniques that security vendors have largely overlooked in favor of focusing on password spraying and MFA fatigue attacks. What makes these particular techniques significant is they expose a fundamental gap in enterprise security architecture: MFA protects the authentication boundary but leaves the token lifecycle unguarded.


    The 3-second attack window is particularly dangerous in a post-pandemic workplace where employees are accustomed to rapid, frictionless authentication across cloud services. A user who sees an OAuth prompt is more likely to click through quickly than a user who receives a traditional phishing email. Social engineering has become *less visible* but *more effective* because it now operates within the bounds of normal system behavior.


    This also signals a strategic shift in how sophisticated threat actors are approaching Microsoft 365 environments. Rather than compete with MFA implementations (which is expensive and unreliable), they've pivoted to attacking the authentication *token* instead of the authentication *mechanism*. It's asymmetrically easier to intercept a browser-based OAuth flow than to defeat MFA at scale.


    The immediate tactical concern: Organizations without token-level logging and monitoring will not detect these attacks until the damage is done—emails forwarded, files exfiltrated, or sensitive information accessed. The strategic concern: As defenders invest in hardening MFA implementations, threat actors have already moved past that layer of defense. The security community is fighting yesterday's battle while OAuth-based attacks scale quietly.


    Organizations need to treat OAuth token compromise with the same urgency they would a credential breach—because functionally, it *is* a credential breach. The token *is* the credential. Without token-level visibility, MFA-first security strategies are incomplete.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)