EnterpriseBleepingComputerabout 2 hours ago
Microsoft 365 accounts hijacked in 3 seconds
1 min read
ClickFix and ConsentFix attacks hijack Microsoft 365 accounts in three seconds by tricking users into executing attacker-supplied commands or approving OAuth consent prompts. ClickFix surged in 2025. ConsentFix shifts the attack surface to Microsoft 365's OAuth consent flows, using trusted platforms like Dropbox or DocSend for delivery.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft
