Microsoft 365 Hijacked in 3 Seconds: ConsentFix & ClickFix Exposed

Michael Miller · 2026-07-02

Imagine this: you're logged into your Microsoft 365 account, checking emails or working on a document. A pop-up appears asking you to approve access to a third-party app. Looks legit, right? In three seconds, you click 'Allow,' and just like that, your account is hijacked. No password stolen. No MFA bypass needed. The attackers have your OAuth token. That's the reality of ConsentFix and ClickFix attacks. They're a new breed of cyber threats that trick users into handing over access to their Microsoft 365 accounts. And they're happening more often than you think. ### How ConsentFix Works ConsentFix attacks exploit the OAuth consent flow. OAuth is a standard that lets third-party apps access your account without sharing your password. It's used by thousands of legitimate apps. But attackers weaponize it. Here's the step-by-step: - An attacker creates a malicious third-party app that looks like a real one (like a document editor or a project management tool). - They send you a link or a pop-up that mimics an official Microsoft prompt asking for permission to access your account. - The prompt asks for specific permissions, like reading your emails, accessing your contacts, or sending messages on your behalf. - If you click 'Accept,' the attacker gets an OAuth token that lets them access your account without needing your password or MFA code. This is a classic MFA bypass. Because you're granting access through a legitimate OAuth flow, Microsoft sees it as a valid action. No red flags raised. ### ClickFix: The Faster, More Deceptive Variant ClickFix takes this a step further. Instead of a standard OAuth prompt, the attacker uses a fake error message or a software update notification. For example, you might see a pop-up saying, "Your browser needs a critical security update. Click here to fix." When you click that button, it triggers an OAuth consent request in the background. You're not even aware you're granting access to an app. The attacker has already hijacked your session. This technique is particularly dangerous because it preys on user urgency. People want to fix errors quickly, especially if they look like official system prompts. The whole process takes about three seconds. ### Why These Attacks Are So Effective There are a few reasons why ConsentFix and ClickFix are so successful: - They bypass traditional security measures like MFA and strong passwords. - They exploit user trust in familiar interfaces and official-looking prompts. - They're hard to detect because they use legitimate OAuth flows. - They don't require any technical skills from the victim—just a click. According to recent reports, these attacks have increased by over 200% in the last year. They target individuals, small businesses, and large enterprises alike. ### How to Defend Against These Attacks Protecting yourself and your organization requires a mix of awareness and technical controls. Here are some practical steps: - **Educate users**: Train employees to never approve OAuth prompts unless they're absolutely sure of the source. If a pop-up looks suspicious, don't click. - **Limit app permissions**: In Microsoft 365 admin center, restrict which third-party apps can request access. Only allow apps from verified publishers. - **Use conditional access policies**: Implement policies that block OAuth consent from untrusted devices or locations. This adds an extra layer of scrutiny. - **Monitor OAuth activity**: Use tools like Microsoft Defender for Cloud Apps to detect unusual OAuth token grants or suspicious app behavior. - **Enable multi-factor authentication (MFA)**: While MFA doesn't stop OAuth-based attacks directly, it makes it harder for attackers to persist after gaining initial access. ### What to Do If You Think You've Been Hit If you suspect a ConsentFix or ClickFix attack, act fast: 1. Revoke all third-party app permissions immediately in your Microsoft 365 account settings. 2. Change your password and enforce MFA re-enrollment. 3. Review account activity for any unauthorized actions (like forwarded emails or new forwarding rules). 4. Report the incident to your IT department or Microsoft support. The key is speed. The longer the attacker has access, the more damage they can do. ### Final Thoughts ConsentFix and ClickFix attacks are a stark reminder that cyber threats evolve faster than our defenses. They exploit human psychology, not just technical vulnerabilities. The best defense is a combination of awareness, training, and robust security policies. Stay vigilant. Don't click on unexpected prompts. And always double-check before granting app permissions. Your Microsoft 365 account depends on it.