ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

This Huntress Labs Tradecraft Tuesday briefing describes ClickFix-style social-engineering attacks and a newer ConsentFix variant that hijacks Microsoft 365 OAuth consent flows by tricking users into dragging local callback links or executing pasted commands, resulting in token/session theft and account takeover; the technique surged in 2025, has working code published on a Russian cybercrime forum, and defenders are advised to combine user awareness with endpoint and identity monitoring to detect unusual PowerShell activity and anomalous session logins.