Microsoft 365 Token Theft via Fake Prompts Exploits OAuth Flows

ConsentFix and ClickFix attacks steal Microsoft 365 tokens within seconds using fake prompt windows that mimic official Microsoft branding. These prompts lure users into authorizing OAuth flows that exchange short‑lived access tokens for long‑term session cookies, giving attackers full control over compromised accounts without triggering any multi‑factor authentication alerts ¹.

The technique was first documented by Huntress Labs, who noted how malicious windows display legitimate logos and UI elements so closely that even vigilant users can be deceived. Once a user approves the request, the attacker gains an OAuth refresh token that permits continued use of the account.

Experts explain that OAuth was originally designed to improve security by delegating permissions rather than sharing passwords. However, ConsentFix/ClickFix exploits this design flaw by presenting a trusted interface that convinces users the prompt is part of the official Microsoft workflow. The result is a social‑engineering attack requiring no additional phishing emails—just one click within what looks like a legitimate dialog box.