ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

ConsentFix and ClickFix attacks can hijack Microsoft 365 accounts in a matter of seconds by exploiting fake prompts and OAuth flows to steal tokens. These tactics are able to bypass multi-factor authentication, allowing for rapid account compromise. The attacks utilize fake prompts to trick users into granting access, ultimately resulting in the theft of Microsoft 365 tokens. The specifics of how these attacks work and potential defense strategies are available for those looking to protect themselves.