ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

ConsentFix and ClickFix are attack techniques targeting Microsoft 365 accounts by stealing authentication tokens within seconds. The attacks leverage fake prompts and malicious OAuth flows to bypass multi-factor authentication (MFA). By exploiting user consent mechanisms and ClickFix-style social engineering, attackers can gain unauthorized access to M365 accounts without needing credentials. These methods are particularly dangerous because they circumvent traditional MFA protections. The article outlines how these tactics work technically and provides guidance on defensive measures organizations can take to protect their Microsoft 365 environments.