{"id":56155,"date":"2026-07-21T11:28:43","date_gmt":"2026-07-21T15:28:43","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=56155"},"modified":"2026-07-21T11:28:43","modified_gmt":"2026-07-21T15:28:43","slug":"consentfix-microsoft-365-account-hijacking","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/consentfix-microsoft-365-account-hijacking\/56155\/","title":{"rendered":"ConsentFix: yet another variation of the ClickFix attack"},"content":{"rendered":"

Cybercriminals are increasingly moving away from complex malware, relying instead on social engineering that exploits a common user habit: mindlessly clicking through endless digital rituals like CAPTCHAs, cookie consents, and authentication prompts. This habit is often targeted by various kinds of the ClickFix<\/a> technique, which threat actors have been actively using lately. Researchers recently discovered a new variant of this technique, which they dubbed ConsentFix<\/a>. It allows attackers to gain unauthorized access to Microsoft 365 accounts via OAuth\u00a0\u2014 a highly popular vector right now<\/a>\u00a0\u2014 thereby completely bypassing the need to steal passwords. For organizations, these attacks present a severe risk of compromised corporate email, exposed documents, and breached cloud resources.<\/p>\n

How ConsentFix works<\/h2>\n

Social engineering lies at the core of all ClickFix variations. Attackers prompt the user to follow a seemingly harmless set of instructions, which actually lead to the compromise of their device or account. In the case of ConsentFix, these instructions are designed to trick the user into granting the attacker access to their Microsoft 365 account.<\/p>\n

The attack begins by making the user believe they must authenticate with their Microsoft account to access a specific page or document. To do this, cybercriminals usually send an email containing a link to a website typically imitating a popular file-sharing service. Attempting to access a specific document on this site prompts the user for verification, which can be obtained by following this sequence of actions:<\/p>\n

    \n
  1. Clicking Verify with Microsoft<\/em>.<\/li>\n
  2. Signing in to the work account, at which point the attackers warn that multi-factor authentication (MFA) may be required.<\/li>\n
  3. After being redirected to a new page, waiting until \u201clocalauth\u201d appears in the address bar.<\/li>\n
  4. Dragging the information icon \u24d8 from the browser\u2019s address bar into a drop zone on the page.<\/li>\n<\/ol>\n

    In practice, following these instructions causes the user to drag an URL containing a session OAuth token directly onto the attacker\u2019s page. This token is exactly what grants the attackers access to the victim\u2019s email and other Microsoft 365 services.<\/p>\n

    The potential fallout of a Microsoft 365 session compromise<\/h2>\n

    At first glance, it might seem like attackers only gain access to a mailbox. In reality, the consequences can be significantly more severe. The attacker\u2019s specific capabilities depend on the organization\u2019s Microsoft 365 license, the services deployed, and the privilege level of the compromised account.<\/p>\n

    Even basic corporate Microsoft 365 subscriptions<\/a> typically grant access to Outlook, Teams, OneDrive, and SharePoint, while more advanced tiers<\/a> may include additional services and administrative tools.<\/p>\n

    Even compromised corporate email alone is a major breach. The attacker not only gains access to email archives that may contain confidential business intelligence, but also can send phishing messages or launch internal BEC attacks<\/a> on behalf of the user.<\/p>\n

    Beyond email, attackers are highly likely to gain access to the victim\u2019s Microsoft Teams account, providing them with even deeper insights and broader leverage for various scams. Access to OneDrive and SharePoint is equally dangerous: it allows attackers to exfiltrate corporate documents, upload malware into cloud storage, tamper with existing files, and more. Ultimately, this creates a launchpad for moving laterally within the corporate infrastructure.<\/p>\n

    Publicly available attack blueprints<\/h2>\n

    According to a Bleeping Computer article<\/a>, the mechanics of ConsentFix are no secret. Attackers share detailed implementation guides on cybercrime forums, offering not only ready-to-use code but also video tutorials demonstrating how to deploy the attack. They also actively trade tips on how they harvest intelligence on organizations and their employees via LinkedIn and other OSINT channels to craft highly convincing phishing messages.<\/p>\n

    Collectively, this significantly lowers the barrier to entry for novice cybercriminals. As these guides and turnkey tools continue to proliferate, ConsentFix attacks will likely become increasingly common. Consequently, organizations should immediately factor this technique into both their defense strategies and employee awareness training programs.<\/p>\n

    How to secure your corporate infrastructure<\/h2>\n

    The emergence of this new ClickFix variation demonstrates that simply blocking a specific keyboard shortcut or an isolated risky action on employee devices is not enough. Clearly, attackers quickly adapt to these measures. Therefore, to protect an organization from these types of attacks, we recommend the following:<\/p>\n