Security experts are warning of two rapidly growing attack methods, ClickFix and ConsentFix, that exploit user behavior to hijack Microsoft 365 sessions. Attackers don’t need to steal passwords or bypass multi-factor authentication through traditional methods. Instead, they exploit legitimate authentication flows and user trust, making the attacks significantly harder to detect.
Over the past year, these techniques have been observed in a growing number of targeted campaigns against businesses and public organizations. Security researchers predict that attacks will continue to increase as they rely on social manipulation and legitimate functionality rather than exploiting technical vulnerabilities.
Modern cyberattacks exploit human behavior
Cybercriminals are increasingly focusing on user behavior rather than technical security flaws. We are used to clicking through CAPTCHA checks, accepting cookie requests, and following on-screen instructions without question.
It is precisely these reflexive actions that attackers exploit.
Instead of forcing firewalls or exploiting software vulnerabilities, they place themselves in the middle of a legitimate workflow and force the user to perform the action that leads to the breach.
ClickFix tricks the user into running the attacker's code
ClickFix is an attack method where the user is presented with a fake verification page that prompts them to perform simple actions, such as using certain key combinations to “confirm” their identity or complete a process.
What looks like a normal verification actually leads to the user unknowingly pasting and running the attacker's commands on their own computer.
No security hole needs to be exploited and no firewall needs to be bypassed. The attacker relies entirely on the user following the instructions.
ClickFix increased sharply in 2025 and is still actively used by several threat actors in attacks against both companies and authorities.
ConsentFix moves the attack to Microsoft 365
The newer attack variant ConsentFix targets Microsoft 365 OAuth-based authentication.
OAuth is an established standard that allows users to grant applications limited access to their accounts without sharing their password. If these access tokens fall into the wrong hands, an attacker can impersonate the legitimate user and gain access to the organization's resources.
The attack usually starts with a phishing email distributed via well-known services like Dropbox or DocSend. In some cases, the document is also password-protected, making it more difficult for security solutions to analyze the content.
When the user opens the document, they are presented with what appears to be a legitimate Microsoft login.
The user is then prompted to complete authentication by dragging a localhost link into the browser.
It is precisely this moment that constitutes the attack.
Instead of completing a legitimate authentication, the user unknowingly passes their OAuth tokens to the attacker. These provide access to the Microsoft 365 session and can be used to access email, documents, Teams, and other Microsoft 365 services without the attacker needing to know the user's password.
The user never enters their login details on a fake website. It is the already approved session that is hijacked.
Why multi-factor authentication doesn't help
Multi-factor authentication remains one of the most important security measures, but it doesn't stop all types of identity attacks.
ConsentFix does not require traditional login.
Instead, the attacker exploits an already authenticated session.
This means that:
- the user's password never needs to be stolen
- no new login is required
- the attacker uses the already authorized session and its OAuth token
- multi-factor authentication has already been completed by the legitimate user
This makes the attack significantly more difficult to identify with traditional security controls.
Attackers share tools openly
In March 2026, a detailed review of ConsentFix was published on an open Russian cybercrime forum.
The material contained working code, completed infrastructure, screenshots, video guides, and detailed instructions for how to build and execute the attack.
The guide also described how attackers map their targets via open sources like LinkedIn before sending their phishing messages. By gathering information about organizations and individual employees, the decoys can be tailored to appear significantly more credible.
This means that advanced attack methods that previously required extensive technical expertise have now become significantly easier to implement.
How organizations can reduce risk
User training is still an important part of security work, but it needs to be supplemented with technical protections.
Because both ClickFix and ConsentFix based on legitimate workflows, organizations need to be able to detect anomalous behavior rather than just blocking known malware.
Security experts recommend, among other things, that organizations:
- educates users to question unusual instructions that require keyboard shortcuts or drag-and-drop actions in the browser
- monitors unusual PowerShell activity launched from normal user processes
- detects new Microsoft 365 sessions from unexpected geographic locations or devices
- regularly reviews OAuth apps and user consents
- restricts users' ability to give consent to third-party applications
- uses Microsoft Entra ID Identity Protection and Conditional Access policies
- monitors suspicious token-based authentication and unusual session changes
- complements with advanced identity and endpoint monitoring to detect compromised sessions at an early stage
Identity and sessions will be the next big security challenge
ConsentFix shows how cyberthreats continue to evolve from traditional phishing to significantly more sophisticated identity attacks where the attacker exploits users' trust in legitimate authentication processes.
Instead of stealing passwords, the active session is stolen.
This makes the attacks faster, more discreet and harder to detect.
For organizations, this means that protection can no longer focus solely on passwords and multi-factor authentication. Identity, active sessions, OAuth permissions, and continuous monitoring are becoming an increasingly important part of a modern Zero Trust effort.
As attackers no longer try to break in through the door, but instead follow the user through the open entryway, security strategies need to change as well. Organizations that combine user education with continuous identity monitoring, risk-based access controls, and ongoing OAuth authorization review will be significantly better positioned to detect and stop the next generation of identity-based attacks before they lead to a full account compromise.
Swedish
Danish
Norwegian
Finnish
English
German
Dutch