ConsentFix Uses a Drag-and-Drop Lure to Steal Microsoft 365 Session Tokens
Summary
ConsentFix uses phishing lures and a localhost callback-link drag-and-drop step to steal Microsoft 365 OAuth session tokens; ClickFix tricks users into running attacker-supplied commands. The article recommends monitoring unusual PowerShell activity and unexpected logis
Key points
- ClickFix prompts users to run attacker-supplied commands using fake verification instructions and keyboard shortcuts.
- ConsentFix targets Microsoft 365 OAuth flows; the described lure asks users to drag a localhost callback link into the browser, exposing session tokens.
- The article says ConsentFix lures may arrive through trusted services such as Dropbox or DocSend.
- By early March 2026, a public Russian cybercrime forum reportedly hosted a ConsentFix walkthrough with code, infrastructure screenshots, and a video tutorial.
- Suggested defensive measures include questioning unusual requests to press hotkeys or drag links, monitoring unusual PowerShell activity, and watching for unexpected session logins.
Article Details
- Topic
- ClickFix and ConsentFix attacks targeting Microsoft 365 accounts through social engineering and OAuth session-token theft.
MITRE ATT&CK
T1204 · User ExecutionClickFix tricks victims into carrying out attacker-directed actions, including pasting and executing commands after following a fake prompt.T1528 · Steal Application Access TokenConsentFix steals OAuth session tokens during the Microsoft 365 consent flow to give attackers session access.