Cybercriminals are exploiting human psychology and Microsoft 365’s OAuth consent mechanisms through sophisticated social engineering attacks dubbed “ConsentFix” and “ClickFix.” These attacks bypass multi-factor authentication (MFA) entirely by tricking users into granting malicious OAuth applications full access to their Microsoft 365 accounts in under three seconds. Unlike traditional credential phishing, these techniques leverage legitimate Microsoft authentication flows, making them exceptionally difficult to detect and devastatingly effective. Organizations relying solely on MFA for protection are discovering that user consent can be weaponized to completely circumvent security controls.
Introduction
Multi-factor authentication has long been promoted as the silver bullet for account security, with organizations implementing MFA mandates across their Microsoft 365 environments. However, a troubling evolution in social engineering tactics is demonstrating that MFA is not the impenetrable barrier many believed it to be. ConsentFix and ClickFix represent a new class of attacks that manipulate users into willingly authorizing malicious applications, effectively rendering MFA irrelevant.
These attacks exploit the OAuth 2.0 authorization framework that underpins modern cloud application integrations. By crafting convincing fake error messages and urgent technical prompts, attackers convince users to click through legitimate Microsoft consent screens, granting third-party applications extensive permissions to read emails, access files, send messages, and maintain persistent access—all without ever stealing a password or compromising MFA tokens.
The speed and simplicity of these attacks make them particularly dangerous. In controlled demonstrations, security researchers have shown that unsuspecting users can be compromised in as little as three seconds, with the entire attack chain requiring just a single click on a malicious OAuth consent link.
Background & Context
OAuth consent abuse is not new, but ConsentFix and ClickFix represent a significant evolution in sophistication and social engineering effectiveness. Traditional OAuth phishing attacks relied on users recognizing and trusting fake login pages. These newer techniques exploit the fact that users have been trained to click through legitimate Microsoft authentication dialogs.
The attack names reflect their methodology. “ClickFix” refers to fake technical error messages that instruct users to “fix” a problem by running a command or clicking a link. “ConsentFix” specifically targets OAuth consent flows, presenting fake error messages that can only be “resolved” by authorizing a malicious application.
Microsoft 365’s extensive OAuth ecosystem creates a large attack surface. Legitimate business applications routinely request broad permissions, conditioning users to accept consent dialogs without careful scrutiny. Attackers exploit this normalization by registering malicious applications with innocuous names like “Microsoft Security Update” or “Office 365 Optimization Tool.”
The attacks have been observed in the wild since late 2023, with significant upticks in 2024. Threat actors are distributing these attacks through compromised websites, malicious advertisements, phishing emails, and even through direct messages from previously compromised accounts, creating a self-propagating attack vector.
Technical Breakdown
The ConsentFix/ClickFix attack chain follows a deceptively simple pattern:
Initial Lure: Users receive a message containing a fake error notification. Common themes include browser security warnings, document access errors, or system update requirements. The message contains a link labeled as a “fix” or “verification” step.
OAuth Application Registration: Attackers pre-register malicious OAuth applications in Azure AD with carefully crafted names and descriptions that appear legitimate. These applications request extensive permissions including:
Mail.Read
Mail.ReadWrite
Mail.Send
Files.Read.All
Files.ReadWrite.All
Contacts.Read
User.Read
offline_accessConsent Prompt: When users click the malicious link, they’re directed to a legitimate Microsoft login page (login.microsoftonline.com). After authentication with their valid credentials and MFA, they’re presented with an authentic Microsoft consent screen requesting permissions for the malicious application.
Permission Grant: The social engineering relies on urgency and authority. Users see their own Microsoft branding, legitimate URLs, and SSL certificates. Under pressure from the fake “error” they’re trying to resolve, they click “Accept” in seconds.
Persistence Mechanism: Once consent is granted, the malicious application receives:
- An OAuth access token with requested permissions
- A refresh token for persistent access
- No requirement for additional authentication
The malicious application can now:
# Example of attacker capabilities post-consent
# Reading emails via Microsoft Graph API
GET https://graph.microsoft.com/v1.0/me/messages
# Exfiltrating files
GET https://graph.microsoft.com/v1.0/me/drive/root/children
# Sending emails on behalf of user
POST https://graph.microsoft.com/v1.0/me/sendMail
Critically, this access persists even if the user changes their password or resets MFA devices. The OAuth token relationship remains valid until explicitly revoked.
Impact & Risk Assessment
The security implications of ConsentFix and ClickFix attacks are severe:
Complete Account Compromise: Attackers gain the same API access as the legitimate user, enabling email monitoring, data exfiltration, internal reconnaissance, and lateral movement through the organization.
MFA Bypass: Since consent grants occur after legitimate authentication, MFA provides zero protection against these attacks. Organizations that have invested heavily in MFA deployment discover their security posture is weaker than assumed.
Persistence: Unlike credential-based compromises that can be remediated through password resets, OAuth consent compromises persist until the specific application permission is identified and revoked—a process many organizations lack procedures for.
Detection Challenges: Legitimate OAuth applications and malicious ones generate similar API traffic patterns. Without proper application governance, distinguishing malicious consent grants from legitimate ones requires manual investigation.
Supply Chain Risk: Compromised accounts can be leveraged to target business partners, clients, and vendors, creating supply chain attack opportunities.
Data Exfiltration: Access to emails and files enables theft of intellectual property, financial data, customer information, and sensitive communications—all through legitimate API channels that bypass data loss prevention (DLP) solutions focused on traditional exfiltration methods.
Organizations in regulated industries face potential compliance violations, as OAuth-based compromises may go undetected during standard security audits focused on traditional indicators of compromise.
Vendor Response
Microsoft has acknowledged the OAuth consent abuse problem and has implemented several controls, though significant gaps remain:
Application Consent Policies: Azure AD now supports admin consent requirements, preventing users from consenting to applications without administrator approval. However, this feature must be manually enabled and configured by tenant administrators.
Publisher Verification: Microsoft introduced publisher verification badges to help users identify legitimate applications. Unverified publishers display warnings, but users under social engineering pressure often ignore these indicators.
Risk-Based Consent: Microsoft’s conditional access policies can block consent requests from suspicious locations or devices, but sophisticated attackers operate through infrastructure that mimics legitimate user behavior.
OAuth App Governance: Microsoft Defender for Cloud Apps provides OAuth application monitoring and risk scoring, but this is a separate license that many organizations haven’t deployed.
Microsoft has not implemented automatic revocation of suspicious consent grants, leaving the burden of detection and response on tenant administrators. The company maintains that user education and proper tenant configuration are the primary defenses, a position that security professionals find inadequate given the sophistication of current social engineering techniques.
Mitigations & Workarounds
Organizations should implement layered defenses against OAuth consent abuse:
Disable User Consent: Configure Azure AD to require administrator approval for all OAuth applications:
# Disable user consent via PowerShell
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{
PermissionGrantPoliciesAssigned = @()
}Implement Consent Workflow: Enable the admin consent request workflow so users can request access to needed applications through a controlled approval process.
Application Governance Policies: Deploy Microsoft Defender for Cloud Apps or third-party OAuth security solutions that provide:
- Automated discovery of consented applications
- Risk scoring based on permissions and publisher trust
- Alerting on high-risk consent grants
- Automated revocation capabilities
Conditional Access Controls: Implement policies that restrict OAuth consent operations based on:
- User location and device compliance
- Application publisher verification status
- Requested permission sensitivity levels
Regular Consent Audits: Establish processes to review OAuth application consents:
# Audit OAuth consents via Microsoft Graph
GET https://graph.microsoft.com/v1.0/oauth2PermissionGrantsNetwork-Level Blocking: Consider blocking access to suspicious OAuth registration patterns at the network perimeter, though this requires sophisticated threat intelligence.
Detection & Monitoring
Effective detection requires visibility into OAuth consent activities and subsequent application behavior:
Azure AD Audit Logs: Monitor for consent grant events:
// Azure Sentinel KQL query for consent grants
AuditLogs
| where OperationName == "Consent to application"
| where Result == "success"
| project TimeGenerated, UserPrincipalName, AppDisplayName,
ConsentType = tostring(TargetResources[0].modifiedProperties)High-Risk Permission Patterns: Alert on applications requesting combinations of read/write access across multiple workloads, especially when combined with offline_access for persistent tokens.
Post-Consent Behavior: Monitor for unusual API activity patterns from newly consented applications:
- Bulk email access shortly after consent
- Large-scale file enumeration
- Unusual sending patterns
- Access from unexpected geographic locations
User Report Mechanisms: Implement easy reporting channels for users who suspect they may have fallen victim to consent phishing, enabling rapid investigation and remediation.
Integration with SIEM: Feed OAuth consent events and application activity logs into security information and event management platforms for correlation with other security signals.
Best Practices
Security Awareness Training: Update training programs to specifically address OAuth consent phishing. Users need to understand:
- How to recognize consent screens
- What permissions are reasonable for different application types
- When to decline consent and report suspicious requests
Least Privilege for Applications: When legitimate applications are approved, grant only the minimum necessary permissions. Many applications request excessive permissions by default.
Application Whitelisting: Maintain an approved application catalog and block consent to applications outside this list.
Incident Response Planning: Develop specific playbooks for OAuth compromise scenarios, including:
- Identification of affected users
- Consent revocation procedures
- Token invalidation processes
- Communication protocols
Multi-Stakeholder Governance: OAuth security requires collaboration between security teams, identity administrators, and application owners. Establish clear ownership and processes.
Zero Trust Principles: Treat OAuth consent as a privileged operation requiring the same scrutiny as administrative access grants.
Key Takeaways
- MFA alone is insufficient: ConsentFix and ClickFix demonstrate that MFA protects credentials but cannot prevent authorization abuse through social engineering.
- OAuth is an attack vector: The same mechanisms that enable seamless cloud application integration create opportunities for persistent compromise through consent manipulation.
- Default configurations are insecure: Organizations must actively disable user consent capabilities in Microsoft 365 to prevent these attacks.
- Detection is challenging: OAuth compromise generates legitimate-looking API traffic, requiring specialized monitoring and governance tools.
- User education is critical: Technical controls must be reinforced with updated security awareness training addressing modern social engineering tactics.
- Incident response requires preparation: Organizations need specific procedures for investigating and remediating OAuth compromises, which differ significantly from traditional credential compromises.
The emergence of ConsentFix and ClickFix attacks represents a maturation of OAuth abuse techniques that all organizations must address through policy, technology, and training updates.
References
- Microsoft Docs: Configure User Consent Settings – https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent
- Microsoft Graph API Permissions Reference – https://learn.microsoft.com/en-us/graph/permissions-reference
- MITRE ATT&CK Technique T1528: Steal Application Access Token – https://attack.mitre.org/techniques/T1528/
- OWASP OAuth Security Cheat Sheet – https://cheatsheetseries.owasp.org/cheatsheets/OAuth_Security_Cheat_Sheet.html
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
