Microsoft 365: New Attacks by ConsentFix and ClickFix

Microsoft 365 accounts are the target of two new attack methods known as ConsentFix and ClickFix. These techniques allow attackers to steal authentication tokens in less than three seconds. The attacks exploit fake prompts and manipulated OAuth flows to bypass Multi-Factor Authentication (MFA). ConsentFix works by tricking users into entering their credentials into fake forms. These forms often resemble legitimate Microsoft login pages, increasing the likelihood that users will disclose their information.

Once obtained, attackers can use the tokens to access accounts without requiring additional authentication. ClickFix, on the other hand, employs a different strategy by getting users to click on links that lead to malicious sites. These sites are designed to prompt users to enter their credentials or disclose other sensitive information. Attackers can then use the acquired tokens for their own purposes. Security researchers warn that these attacks are particularly dangerous as they can circumvent the security measures that companies have implemented.

The use of MFA is often regarded as one of the best methods for securing accounts, yet these new techniques demonstrate that even these protective measures may not always be sufficient. To protect against these attacks, experts recommend educating users about the risks and ensuring they are aware of the signs of phishing attacks. Companies should also ensure that their security policies are regularly updated to address new threats. Additionally, it is advised that companies implement security solutions capable of detecting suspicious activities in real-time. Such systems can help identify and stop attacks early before they can cause significant damage.

Microsoft has already responded to the threat and is working on updates to close the security gaps exploited by these attacks. However, the exact details of the planned security improvements have not yet been disclosed. The ConsentFix and ClickFix attacks are part of a growing trend where cybercriminals attempt to bypass corporate security measures. According to a recent study, 75% of companies have fallen victim to phishing attacks in the past 12 months, underscoring the urgency of developing effective security strategies. The vulnerability exploited by these attacks could also impact other platforms that use similar authentication mechanisms.

Experts advise reviewing and adjusting security practices beyond Microsoft 365 as necessary. Some companies have already begun revising their MFA strategies to ensure they are equipped against these new attacks. Implementing additional security measures could be crucial in maintaining account integrity. The threat posed by ConsentFix and ClickFix illustrates that cybercrime is constantly evolving, and companies must continuously adapt. Security researchers emphasize that raising user awareness of these threats is a vital step toward improving overall security. Microsoft plans to roll out security enhancement updates to all users by the end of September 2026.