--- title: Hackers Stole Your Account (for free) | daily.dev description: ConsentFix is an emerging identity-based attack technique that abuses Microsoft's legitimate OAuth2 device code flow to steal access tokens entirely within the... canonical: https://daily.dev/posts/hackers-stole-your-account-for-free--py8oxdkit twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers Stole Your Account (for free) | daily.dev og:description: ConsentFix is an emerging identity-based attack technique that abuses Microsoft's legitimate OAuth2 device code flow to steal access tokens entirely within the... og:url: https://daily.dev/posts/hackers-stole-your-account-for-free--py8oxdkit og:image: https://api.daily.dev/og/posts/pY8oXdKIt.png og:image:alt: Hackers Stole Your Account (for free) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers Stole Your Account (for free) **[John Hammond](https://daily.dev/sources/johnhammond)** · 14 min read · 0 upvotes · 0 comments ## Summary ConsentFix is an emerging identity-based attack technique that abuses Microsoft's legitimate OAuth2 device code flow to steal access tokens entirely within the browser, leaving no EDR or antivirus artifacts. Unlike traditional ClickFix attacks that target the endpoint, ConsentFix tricks users into copying a localhost redirect code that hands attackers refresh and access tokens to a victim's Entra ID environment. A detailed tutorial posted on a cybercrime forum (XSS) demonstrates the full attack chain using free tools like Pipedream, Cloudflare Workers, GoLogin, and DocSend, enabling post-exploitation across Outlook, OneDrive, SharePoint, and Teams. Dark web monitoring via Flare shows growing criminal interest in the technique since December 2024, suggesting it will evolve similarly to how ClickFix proliferated. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds](https://daily.dev/posts/consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds-nxcshj9kg) · BleepingComputer · 2 upvotes · 0 comments - [The Hacker's 2026 Playbook: Dark Web Tactics Targeting You](https://daily.dev/posts/the-hacker-s-2026-playbook-dark-web-tactics-targeting-you-dk5g8aqns) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/hackers-stole-your-account-for-free--py8oxdkit) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers Stole Your Account (for free)","url":"https://daily.dev/posts/hackers-stole-your-account-for-free--py8oxdkit","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-stole-your-account-for-free--py8oxdkit"},"datePublished":"2026-04-23T13:12:49.208Z","dateModified":"2026-04-23T13:13:09.674Z","description":"ConsentFix is an emerging identity-based attack technique that abuses Microsoft's legitimate OAuth2 device code flow to steal access tokens entirely within the...","image":"https://i.ytimg.com/vi/T3oVdPCMDJw/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/T3oVdPCMDJw/sddefault.jpg","isAccessibleForFree":true,"articleSection":"John Hammond","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"John Hammond","logo":"https://media.daily.dev/image/upload/s--Oh7b_KW---/f_auto/v1729363281/logos/johnhammond","url":"https://daily.dev/sources/johnhammond"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-stole-your-account-for-free--py8oxdkit","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber","timeRequired":"PT14M","video":{"@type":"VideoObject","name":"Hackers Stole Your Account (for free)","description":"ConsentFix is an emerging identity-based attack technique that abuses Microsoft's legitimate OAuth2 device code flow to steal access tokens entirely within the...","thumbnailUrl":"https://i.ytimg.com/vi/T3oVdPCMDJw/sddefault.jpg","uploadDate":"2026-04-23T13:12:49.208Z","duration":"PT14M","url":"https://api.daily.dev/r/pY8oXdKIt","embedUrl":"https://www.youtube.com/embed/T3oVdPCMDJw"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"John Hammond","item":"https://daily.dev/sources/johnhammond"},{"@type":"ListItem","position":3,"name":"Hackers Stole Your Account (for free)"}]} ```