ConsentFix & ClickFix: Microsoft 365 Hijacked in 3 Seconds

Robert Moore · 2026-07-02

You've probably heard the warnings about phishing and password theft, but there's a new breed of attack that's way more sneaky. It's called ConsentFix and ClickFix, and it can hijack your Microsoft 365 account in just 3 seconds, even bypassing that multi-factor authentication (MFA) you thought was bulletproof. Let's break down how these attacks work and, more importantly, how you can stop them. ### The Anatomy of a 3-Second Hijack Here's the scary part: these attacks don't rely on stealing your password. Instead, they trick you into granting permission to a fake app that looks legitimate. You click a link, see a familiar Microsoft login prompt, and enter your credentials. Then, you're hit with a request that seems normal, like "Allow this app to access your email." But in that split second, you've handed over the keys to your entire account. The attacker uses a malicious OAuth application. Once you approve it, they can access your emails, contacts, and even your OneDrive files without ever needing your password again. And because you already passed MFA during the login, the attacker gets a free pass too. ### Why MFA Isn't Enough Anymore We've all been told that MFA is the gold standard for security. But these attacks exploit a loophole: once you authenticate, the attacker steals the session token. That token proves you're you, so the system trusts everything that follows. It's like handing over your house key after you've already unlocked the front door. Think of it this way: MFA is a guard at the gate. But ConsentFix and ClickFix trick you into opening a side door for the attacker. The guard never sees them, and your data is gone before you even notice. ### How to Spot a Fake Prompt These attacks are designed to look real, but there are red flags. Here's what to watch for: - **Check the app name**: If it's something generic like "Calendar Sync" or "Microsoft Support," be suspicious. Legit apps have clear, unique names. - **Look at the permissions**: If the app asks for access to your entire mailbox or all your files, that's a huge red flag. A real app would only need limited access. - **Examine the URL**: The prompt should come from a Microsoft domain, like `login.microsoftonline.com`. If it's a random string or a misspelled URL, don't click. If something feels off, close the browser tab and contact your IT team. Don't click "Accept" out of habit. ### Defending Your Microsoft 365 Environment Here's the good news: you can fight back. Start by implementing conditional access policies in Azure AD. These policies can block apps that come from unknown sources or that request overly broad permissions. You can also set up a policy that requires admin approval for any OAuth app, so users can't accidentally grant access. Another layer is user education. Run a quick training session with your team. Show them what a fake prompt looks like and emphasize that they should never approve an app they didn't request. A 5-minute meeting could save your company from a data breach. ### The Final Word on Staying Safe ConsentFix and ClickFix are just the latest tricks in the hacker's playbook, but they don't have to catch you off guard. Stay skeptical of every prompt, double-check permissions, and keep your security settings tight. Remember, the strongest defense is a cautious click. Your data is worth more than a 3-second mistake. Stay sharp out there.