Attackers are no longer breaking into accounts; they're being invited in. Two emerging attack techniques, dubbed ConsentFix and ClickFix, are redefining social engineering by exploiting the very prompts users have been trained to trust. By hijacking OAuth consent flows and Windows dialog boxes, these methods silently seize control of Microsoft 365 environments, often without a single stolen password.

Security researchers have long warned that the weakest link in any system is the human element. Yet, as organizations have hardened their perimeters against credential theft, adversaries have adapted—shifting from credential harvesting to session and token theft, and now to what can only be described as consent-based attacks. ConsentFix and ClickFix represent the next evolution: attacks that not only fool users but also bypass traditional security controls by design.

ConsentFix is an advanced form of OAuth consent phishing, a technique Microsoft has been battling for years. In a typical consent phishing attack, a malicious application registered in Entra ID (formerly Azure AD) tricks a user into granting it permissions to read their mail, access files, or send emails on their behalf. The attack relies on a legitimate OAuth 2.0 consent screen—the same one users see when connecting a third‑party app to their Microsoft 365 account.

What makes ConsentFix different is its dynamic, context‑aware approach. Instead of a one‑size‑fits‑all malicious app, ConsentFix kits generate customized consent screens that mimic the victim’s organization branding, use familiar application names, and request only the minimal permissions needed to avoid suspicion. They often impersonate productivity tools like “Zoom Scheduler,” “DocuSign Viewer,” or “HR Benefits Platform,” making the consent prompt appear routine.

Once a user clicks “Accept,” the malicious OAuth app receives a token that can be immediately used to:

  • Read and exfiltrate all emails
  • Access SharePoint and OneDrive files
  • Send phishing emails from the victim’s account to other employees
  • Create persistence mechanisms, such as mailbox rules or forwarding addresses

The token is often a refresh token, meaning the attacker retains access even if the user changes their password. Because the authentication event is legitimate, it bypasses multi‑factor authentication (MFA) entirely—the user provides MFA at the time of consent, so the token is fully validated.

ClickFix: Weaponizing the Windows Prompt

If ConsentFix exploits OAuth, ClickFix takes aim at the operating system itself. ClickFix attacks trick users into executing malicious commands by disguising them as routine Windows prompts. The technique co‑opts built‑in Windows dialog boxes—like the “Run” command, User Account Control (UAC) prompts, or even the Windows Security credential window—to run scripts, download malware, or steal credentials.

A typical ClickFix attack might unfold like this:

  1. A user receives a phishing email claiming to be from IT support, urging them to “Fix a sync issue” by pressing Windows+R and pasting a command.
  2. The command appears innocuous: it might be a PowerShell one‑liner encoded in Base64, or it might open a legitimate‑looking website that then triggers a download.
  3. Because the user initiates the action, endpoint detection and response (EDR) tools often trust the process, as it appears to be intentional user behavior.

ClickFix gets its name from the rising trend of “click‑fix” scams in technical support forums, where users are told to run commands to “repair” their PC. Attackers have refined this into a scalable attack vector, leveraging anything from fake CAPTCHA pages to spoofed Windows Update notifications.

What makes ClickFix particularly dangerous is its ability to bypass application control and code‑integrity policies. If an organization allows PowerShell or Command Prompt to run (as nearly all do for legitimate administration), a user‑launched command is indistinguishable from an admin’s work—until it’s too late.

Why These Attacks Are Succeeding

The shared genius of ConsentFix and ClickFix is their exploitation of trusted user‑interface patterns. For decades, security awareness training has taught users to look for HTTPS, verify sender addresses, and avoid suspicious attachments. But no amount of training prepares a user to reject a dialog box that looks exactly like the ones they see every day.

ConsentFix attacks, for instance, have been observed using legitimate OAuth providers—even Microsoft’s own verification program. A malicious app can be published as a “verified publisher” after minimal social engineering, lending it Microsoft’s blue badge of trust. When the consent screen appears, it looks identical to that of a legitimate integration.

ClickFix capitalizes on the “spectre of the help desk.” Employees are conditioned to follow instructions from IT: “Press Win+R, type ‘cmd’, and paste this command to apply the security patch.” In a hybrid work era where real IT communications often arrive via email or chat, distinguishing a genuine request from a malicious one becomes nearly impossible.

Moreover, traditional security tools struggle to detect these attacks. Neither an OAuth consent grant nor a user‑initiated command is inherently malicious. Defender for Office 365 can flag suspicious OAuth apps, but it cannot block the consent flow once the user clicks “Accept.” Similarly, endpoint protection platforms may monitor process creation but often treat user‑launched processes as benign unless they exhibit known malicious indicators.

The Microsoft 365 Kill Chain: What Attackers Gain

Once attackers gain a foothold via ConsentFix or ClickFix, they can move laterally across the Microsoft 365 ecosystem with terrifying speed. A typical kill chain might look like this:

  1. Initial Access: User grants consent to a rogue OAuth app or executes a malicious Windows command.
  2. Persistence: The attacker uses the refresh token to create an inbox rule that hides all replies from IT, or registers a new device in Entra ID to maintain access.
  3. Privilege Escalation: By reading the victim’s email, the attacker discovers which colleagues have elevated privileges and targets them with further consent phishing or ClickFix lures.
  4. Data Exfiltration: Using the Microsoft Graph API, the attacker silently downloads sensitive SharePoint documents, Teams messages, or entire mailboxes.
  5. Impact: The attacker may commit financial fraud by sending fake invoices, or hold data for ransom, or simply sell the access on the dark web.

ClickFix adds an additional layer: because the attacker has code execution on the Windows endpoint, they can pivot from the cloud to the on‑premises network via the compromised device. This creates a dangerous hybrid attack surface where cloud‑only defenses are blind to the on‑device activity, and vice versa.

Real‑World Incidents and the Growing Trend

While the terms ConsentFix and ClickFix are relatively new, the underlying techniques have been observed in multiple high‑profile breaches. In early 2024, a campaign dubbed “MFA‑Bypassed” used sophisticated consent phishing to compromise thousands of Microsoft 365 tenants across the finance and healthcare sectors. Attackers registered “verified” apps with names like “Adobe PDF Viewer” and “SecureShare,” gaining access to emails and files for weeks before detection.

ClickFix‑style attacks have been linked to the rise of “ClickFix bots” on messaging platforms like Telegram and Discord. These bots guide unsuspecting users through a series of steps—often promising free software or game cheats—ultimately leading to the execution of infostealer malware. Because the user performs the actions, browser isolation and sandboxing provide little protection.

Microsoft’s security research teams have repeatedly warned about the consent phishing threat, releasing tools like App Governance and Risk Detections in Microsoft Defender for Cloud Apps. Yet the pace of innovation among attackers outstrips the rollout of these protections. ClickFix, in particular, remains under‑discussed in enterprise security circles, despite its potential to completely bypass EDR suites.

Defending Against ConsentFix and ClickFix

Mitigating these threats requires a layered approach that combines technical controls, policy enforcement, and a fundamental rethink of security awareness.

Technical Controls

  • OAuth Consent Restrictions: The single most effective defense against ConsentFix is to restrict user consent to apps from verified publishers, or to require an administrator review for any consent request. In Entra ID, configure the “User consent for apps” setting to “Do not allow user consent” or “Allow user consent for apps from verified publishers, for selected permissions.” This blocks the vast majority of malicious consent attempts.
  • App Governance Policies: Use Microsoft Defender for Cloud Apps to set policies that detect anomalous OAuth app activity, such as a new app reading email on multiple mailboxes shortly after consent.
  • Endpoint Command Restrictions: To combat ClickFix, consider removing local administrator rights and restricting the use of PowerShell and Command Prompt to authorized personnel via AppLocker or Windows Defender Application Control (WDAC). Additionally, configure Attack Surface Reduction (ASR) rules to block suspicious scripts and LOLBin (living‑off‑the‑land binary) abuse.
  • Conditional Access and Continuous Access Evaluation: Even if an attacker obtains a token, Conditional Access policies can block access based on device compliance, location, or risk level. Continuous Access Evaluation (CAE) can immediately revoke tokens when a user’s risk profile changes.

Policy and Process

  • Least Privilege: Users who do not need to install apps or run administrative commands should not have those capabilities. Implement just‑in‑time (JIT) access for privileged operations.
  • App Registration Hygiene: Regularly audit the apps registered in your Entra ID tenant. Remove any unused or suspicious service principals. Use the Microsoft Graph API to script periodic reviews.

Security Awareness 2.0

  • Teach the “Consent Paradox”: Users must understand that a legitimate‑looking Microsoft consent screen is not a guarantee of safety. Train them to pause and ask: “Did I initiate this app connection?” and “Does this app really need these permissions?”
  • Simulated Phishing for Commands: Just as organizations run phishing simulations, they should run ClickFix simulations—sending benign “run this command” lures and measuring who complies. This data can drive targeted retraining.
  • Contextual Warnings: Work with IT to ensure that any legitimate IT communications come through known channels (e.g., an internal portal, not email), and that any email asking for command execution should be verified via a separate communication method.

The Road Ahead: A New Era of Social Engineering

ConsentFix and ClickFix are not mere fads; they are the logical next step in social engineering’s evolution. As operating systems and cloud services become more secure against automated attacks, the human element remains the one attack surface that cannot be fully patched. The prompts we’ve designed for convenience—consent dialogs, UAC boxes, and the Run command—are now weapons in an adversary’s arsenal.

Microsoft is actively investing in countermeasures. Future updates to Entra ID are expected to include more granular consent insights and risk‑based consent prompts that flag unusual requests. On the Windows side, SmartScreen and Windows Defender are evolving to detect suspicious command patterns, but the cat‑and‑mouse game will continue.

The key takeaway for IT leaders: secure your permission models now. Block user consent by default, lock down endpoints, and revamp training to confront the reality that the most dangerous attacks don’t break in—they simply ask for access. In the world of ConsentFix and ClickFix, a single click can cost you your entire cloud estate.