ConsentFix is a newly identified variation of the ClickFix social engineering attack that compromises Microsoft 365 accounts by exploiting OAuth token granting processes. Attackers send phishing emails linking to fake file-sharing sites that prompt users to authenticate with their Microsoft 365 accounts and perform a sequence of browser actions, including dragging an OAuth token URL into a drop zone controlled by the attacker. This grants attackers access to the victim's Microsoft 365 session without requiring password theft or bypassing multi-factor authentication. The attack can expose corporate email, Teams, OneDrive, SharePoint, and other services depending on the organization's subscription and privileges. Publicly available attack blueprints and tutorials facilitate widespread adoption of this technique. Defenses include robust email gateway security and ongoing user training to recognize and resist social engineering tactics.

Successful exploitation results in unauthorized access to Microsoft 365 accounts, allowing attackers to read and send corporate emails, access Teams communications, exfiltrate or tamper with documents on OneDrive and SharePoint, and potentially move laterally within the corporate network. This can lead to data breaches, business email compromise, internal phishing, malware deployment, and broader organizational compromise. The attack bypasses password theft and multi-factor authentication, increasing its effectiveness against standard security controls.

No official patch is applicable as this is a social engineering attack exploiting OAuth flows. Organizations should deploy strong email gateway security solutions to reduce phishing email delivery. Regular cybersecurity awareness training is critical to educate employees about the ConsentFix technique and similar social engineering tactics. Blocking specific browser actions is insufficient due to attacker adaptability. Monitoring and restricting OAuth app permissions within Microsoft 365 can also help reduce risk. Organizations should incorporate this threat into their security awareness programs and incident response plans.