How Attackers Use ClickFix and Stolen Session Tokens to Hijack Microsoft 365 Accounts
Summary
A Huntress webinar walkthrough shows how attackers can use phishing and ClickFix to steal Microsoft 365 session tokens, bypass MFA, hijack an account, and abuse inbox rules and connected services. The article also outlines defensive measures.
Key points
- The article describes a fictional demonstration in which an attacker starts with stolen credentials for a Microsoft 365 account.
- A phishing link leads to a fake login page that uses a CAPTCHA-themed ClickFix prompt to persuade the user to run a malicious PowerShell command.
- The command runs an infostealer script that steals active browser session cookies, which the attacker imports to access the account and bypass MFA.
- After gaining access, attackers may create inbox rules to forward sensitive messages or hide them in less-visible folders.
- The walkthrough describes possible follow-on actions, including impersonating a user in Teams to request an MFA device change and using email password resets to access other applications.
- Suggested defenses include conditional access policies, reviewing connected apps and inbox rules, email authentication, practiced incident response, and user education.
Article Details
- Topic
- Cybercriminal identity attacks using phishing and ClickFix to steal session tokens, hijack Microsoft 365 accounts, and move laterally
MITRE ATT&CK
T1021.003 · Distributed Component Object ModelAttackers use Microsoft Teams to socially engineer IT support and seek registration of a new MFA device.T1059.001 · PowerShellThe ClickFix flow prompts the victim to run a malicious PowerShell command.T1114.003 · Email Forwarding RuleMalicious inbox rules forward or move selected emails to conceal activity and collect information.T1528 · Steal Application Access TokenThe infostealer script steals active browser session tokens.T1550.004 · Web Session CookieAttackers import stolen session tokens into a browser to impersonate the victim and bypass MFA.T1566 · PhishingAttackers use social-engineering emails with links to phishing pages.
People
Vendors
Products
Cookie EditorWith the stolen session tokens, Kyle uses a free browser extension called Cookie Editor to import them into his browser.Google WorkspaceIf a hacker can log into your Microsoft 365 or Google Workspace account, they can potentially move laterally and gain access to everything you're connected to.Microsoft 365 Apps for EnterpriseInstead, they shop on the dark web for stolen identities and abuse the built-in functionality of the legitimate tools and platforms you rely on every day, like Microsoft 365.