Multi-factor authentication was supposed to end the era of stolen passwords. A pair of techniques making the rounds, ConsentFix and ClickFix, are a reminder that attackers stopped going after passwords a while ago.

As BleepingComputer reports, the two methods hijack Microsoft 365 accounts in seconds by stealing the session token, the small credential your browser is handed after you log in and clear MFA. ClickFix is the social half: a fake "paste this to fix the problem" prompt that gets a user to run something. ConsentFix is the technical half: a malicious OAuth consent screen that tricks the user into granting a rogue app access. Either way, the attacker leaves with a token that was issued after authentication, which means MFA never gets a second look.

This is the uncomfortable frontier of identity security. "We have MFA" has quietly become a sentence that means less than people think, because token theft sidesteps it entirely, and most organizations have never actually tested whether their own Microsoft 365 tenant would stop a ConsentFix-style consent grant or notice a stolen token being replayed.

The immediate moves are concrete: restrict third-party OAuth app consent to admin approval, turn on conditional access and token binding, and teach people that no legitimate fix ever asks them to paste a command or approve a surprise permission. But the deeper move is to stop treating MFA as a box that is either checked or not, and to start testing whether it actually holds against the specific way attackers now get around it.

Sources: BleepingComputer.