Hackers Stole Your Account (for free)

ConsentFix is an emerging identity-based attack technique that abuses Microsoft's legitimate OAuth2 device code flow to steal access tokens entirely within the browser, leaving no EDR or antivirus artifacts. Unlike traditional ClickFix attacks that target the endpoint, ConsentFix tricks users into copying a localhost redirect code that hands attackers refresh and access tokens to a victim's Entra ID environment. A detailed tutorial posted on a cybercrime forum (XSS) demonstrates the full attack chain using free tools like Pipedream, Cloudflare Workers, GoLogin, and DocSend, enabling post-exploitation across Outlook, OneDrive, SharePoint, and Teams. Dark web monitoring via Flare shows growing criminal interest in the technique since December 2024, suggesting it will evolve similarly to how ClickFix proliferated.