BreachPublished 2 Jul 2026

ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

Source Bleeping Computer

Description

ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA bypass tactics work and how to defend against them. [...]

Impact

Successful exploitation results in attackers obtaining Microsoft 365 access tokens, potentially allowing unauthorized access to user accounts and associated resources. The attacks bypass MFA protections by abusing OAuth consent mechanisms. However, no direct software vulnerability or exploit code is indicated, and no widespread exploitation is reported.

Defensive guidance

Since these attacks rely on social engineering and OAuth consent flows, mitigation should focus on user awareness training to recognize suspicious consent prompts and on implementing conditional access policies that restrict OAuth app permissions. Organizations should review and limit OAuth app consent permissions and monitor for unusual consent grants.

References

bleepingcomputer.com/news/security/consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Jul 2026, 14:21 UTC

References

Community reviews