Verified, Sponsored, and Still Dangerous: The Trust Signals Cybercriminals Are Learning to Hijack

Two separate techniques show how attackers are leaning on user trust - one through a promoted macOS lure, the other through browser-based Microsoft 365 token abuse.

When the Consent Screen Becomes the Crime Scene

ConsentFix and ClickFix show how a fake prompt and an OAuth flow can turn Microsoft 365 identity controls into a fast-moving token theft problem.

Hijacking Trust: How "ConsentFix" Broke Microsoft's Defenses in a Browser-First Phishing Blitz

A fast-evolving phishing technique exposes the cracks in OAuth security-and the urgent need for new detection strategies.

Stolen Consent: How Hackers Hijack Microsoft Entra with OAuth Sleight of Hand

A new attack dubbed "ConsentFix" lets cybercriminals bypass trusted Microsoft authentication-and snatch the keys to the cloud.

Microsoft’s Trusted Tool Turned Trojan: Inside the ConsentFix Cloud Account Heist

Phantoms in the Cloud: How “ConsentFix” Outsmarted Microsoft’s Defenses

How Hackers Are Bypassing Passwords and MFA: Inside the ConsentFix Microsoft Account Heist

A new social engineering scheme lets attackers seize Microsoft accounts without ever asking for your password-or triggering security warnings.