What ConsentFix Teaches Us About Microsoft 365 Phishing

Phishing attacks are constantly evolving, and a recent campaign known as ConsentFix highlights just how creative attackers have become. This technique targets Microsoft 365 users and can bypass both passwords and multi-factor authentication. Understanding how it works—and the simple habit that stops it—can help keep your organization safe.

Why ConsentFix Matters to Small Businesses

Many small businesses and nonprofits rely on Microsoft 365 for email, documents, and collaboration. Because these accounts hold sensitive data, they are prime targets for attackers. ConsentFix is especially concerning because it does not require users to enter a password or respond to a multi-factor authentication prompt. Instead, it tricks users into granting access in a way that looks legitimate, making traditional security awareness training even more important.

How the ConsentFix Attack Works

ConsentFix is delivered through trusted platforms like Dropbox or DocSend, and sometimes through search-engine links that bypass email filters. Victims receive a lure—often a document or link—that leads to a page mimicking a Microsoft sign-in. Instead of asking for a password, the page asks users to drag, copy, or paste a special link into their browser as a verification step.

That link is not harmless. When a user follows this instruction, it sends an authorization code to the attacker, who can then redeem it for access to the victim's Microsoft 365 account. Because this process uses a trusted Microsoft app and does not involve a standard login, it bypasses both passwords and multi-factor authentication. Even passkeys do not prevent this type of attack, since the login step is skipped entirely.

It is important to note that the OAuth system being abused here is a legitimate Microsoft feature. Attackers are simply finding creative ways to trick users into granting access.

Best Practices to Prevent ConsentFix Attacks

• Never copy, paste, or drag a link as part of a sign-in or verification step. Real Microsoft sign-ins never ask you to do this.
• Be cautious with documents or links received via Dropbox, DocSend, or unfamiliar websites, especially if they ask for unusual actions.
• Continue to use strong passwords and multi-factor authentication. While this attack sidesteps those protections, they remain essential for other threats.
• Encourage staff to report any sign-in page or prompt that seems unusual or asks for unexpected steps.
• Regularly review and audit app permissions in your Microsoft 365 environment to spot suspicious access.
• Stay informed about the latest phishing tactics and share updates with your team.

How NIS Helps Reduce the Risk

At NIS, we monitor emerging phishing campaigns and update our guidance to help clients stay protected. We provide user awareness training that covers new tactics like ConsentFix, and we regularly review Microsoft 365 security settings to limit unnecessary app permissions. Our team is available to answer questions and help investigate any suspicious sign-in prompts or activities.

Phishing attacks continue to evolve, but a single habit—never copying or dragging a link as part of a sign-in—can block this particular threat. If you have questions or want to review your organization's Microsoft 365 security, NIS is here to help.