Full Report
Cybercriminals are hijacking Microsoft 365 accounts in seconds. Learn the 2026 hacker tactics, including ConsentFix, that bypass security training and exploit normal user behavior.
Analysis Summary
# Tool/Technique: ConsentFix
## Overview
ConsentFix is a sophisticated social engineering and session hijacking technique emerging in 2026. It evolves the "ClickFix" methodology by exploiting Microsoft 365 OAuth consent flows. Rather than stealing credentials, it tricks users into performing manual browser actions—such as dragging a localhost callback link—to hand over active session tokens, effectively bypassing Multi-Factor Authentication (MFA).
## Technical Details
- **Type:** Technique / Attack Framework
- **Platform:** Microsoft 365 (SaaS), Web Browsers (Chrome, Edge, etc.)
- **Capabilities:** Token theft, MFA bypass, automated reconnaissance, and session hijacking.
- **First Seen:** Reported as exploding in early 2026 (building on 2025 ClickFix tactics).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- [T1557 - Adversary-in-the-Middle]
- **[TA0004 - Privilege Escalation]**
- [T1548 - Abuse Elevation Control Mechanism] (Social Engineering)
- **[TA0005 - Defense Evasion]**
- [T1550.004 - Use Alternate Authentication Material: Web Session Cookie/Token]
## Functionality
### Core Capabilities
- **OAuth Abuse:** Exploits legitimate Microsoft 365 authentication flows to request permissions for malicious applications.
- **Token Extraction:** Uses "drag-and-drop" browser interactions to capture `localhost` callback links containing sensitive OAuth tokens.
- **Phishing Lures:** Utilizes trusted hosting platforms like Dropbox and DocSend to host password-protected files, evading automated email scanners.
### Advanced Features
- **Infrastructure Masking:** Leverages legitimate cloud services (Cloudflare Pages, `workers.dev`, Pipedream) to host the attack backend.
- **Targeting Intelligence:** Attackers integrate reconnaissance data from LinkedIn, ZoomInfo, and `Hunter[.]io` to create highly personalized lures.
- **MFA Bypass:** Because the attacker captures the resulting session token after the user has successfully performed MFA, the secondary security layer is rendered ineffective.
## Indicators of Compromise
- **File Hashes:** N/A (Primarily browser-based and script-driven).
- **File Names:** N/A (Often delivered via DocSend/Dropbox links).
- **Network Indicators:**
- `workers[.]dev` (Abused for callback logic)
- `pipedream[.]com` (Abused for webhooks)
- `cloudflarepages[.]com` (Abused for phishing landing pages)
- **Behavioral Indicators:**
- Users navigating to unusual `localhost` or loopback addresses during a sign-in flow.
- Unexpected OAuth application authorizations in Microsoft 365 Entra ID logs.
- "Drag-and-drop" events occurring on login pages involving URL objects.
## Associated Threat Actors
- Cybercriminals active on Russian-language dark web forums (Blueprints and code shared publicly in March 2026).
## Detection Methods
- **Behavioral Detection:** Monitoring for the registration of "Enterprise Applications" with broad permissions (e.g., `Mail.Read`, `Notes.Read.All`, `Files.Read.All`).
- **Log Analysis:** Auditing Microsoft Entra ID (Azure AD) sign-in logs for suspicious `UserAgent` strings or logins from unexpected geographic locations immediately following a token grant.
- **Endpoint Monitoring:** Detecting "ClickFix" precursors like unauthorized commands executed via `Win+R` followed by clipboard pastes.
## Mitigation Strategies
- **Prevention Measures:** Implement "Strict" Phishing-Resistant MFA (FIDO2/Security Keys) which binds the session to the hardware.
- **Hardening Recommendations:**
- Restrict user ability to consent to apps (require Admin Consent).
- Implement Conditional Access policies that require managed devices (Compliant/Hybrid Joined).
- Reduce session lifetimes for highly sensitive roles.
- **User Training:** Update security awareness to warn against "manual" steps in login flows, such as dragging links or running `Win+R` commands.
## Related Tools/Techniques
- **ClickFix:** The predecessor technique involving `Win+R` and `Ctrl+V` to execute malicious code via social engineering.
- **EvilProxy / AiTM Frameworks:** Automated tools used for transparent proxying of login sessions.
- **Illicit Consent Grant:** The broader category of attacks involving malicious OAuth apps.