Detecting ConsentFix: The OAuth Phishing Attack That Bypasses MFA

Wambua Thyaka@thyaka

•updated Jan 16, 2026•84•6•710

This attack shares a lot of similarities with ClickFix/FileFix, AiTM phishing, and OAuth Consent Phishing. You can think of this as a browser-native ClickFix attack that phishes an OAuth token on a target app by getting the victim to copy and paste a URL containing OAuth key material into a phishing page.