New Phishing Tactics Exploit OAuth Tokens in Microsoft 365 Accounts A sophisticated phishing campaign, dubbed ConsentFix, is targeting Microsoft 365 users by exploiting trusted platforms like Dropbox and DocSend to bypass security measures. Attackers send seemingly legitimate, password-protected lures that evade antivirus detection. Once opened, victims are tricked into dragging a localhost callback link into their browser or executing keyboard shortcuts (e.g., Windows key + R, Ctrl+V), unknowingly handing over OAuth tokens that grant full account access without requiring passwords or multi-factor authentication (MFA). The attack, first documented on a Russian cybercrime forum in early 2026, was shared as a step-by-step guide complete with code, infrastructure screenshots, and a video tutorial. This "playbook" lowers the barrier for entry, enabling even low-skilled threat actors to launch high-impact attacks. The campaign leverages free services like Cloudflare Pages and Pipedream webhooks to host malicious infrastructure, while LinkedIn and ZoomInfo data is used to tailor phishing lures to specific targets. Why It Works ConsentFix exploits routine user behavior, such as clicking through OAuth consent prompts or following familiar sign-in flows. Unlike traditional phishing, victims don’t enter credentials into fake forms instead, they complete what appears to be a legitimate authentication process, inadvertently surrendering session tokens. The attack is fast (under three seconds) and leaves minimal traces, though defenders can detect anomalies like suspicious PowerShell activity or unusual login locations. Impact Once compromised, attackers gain access to email, OneDrive, Teams, and other Microsoft 365 resources, enabling data theft, lateral movement, or further phishing campaigns. The technique has evolved from earlier variants like ClickFix, which relied on similar social engineering tactics but with even less technical friction. The campaign highlights a broader trend: cybercrime as a service (CaaS), where attack methods are packaged and distributed with step-by-step instructions, accelerating the spread of identity-based threats.