The hacker’s 2026 playbook is not always a clever hack

The old stereotype of phishing is becoming less useful.

A convincing cyber attack does not always arrive as a badly written email, a suspicious attachment or an obvious fake login page. Increasingly, it appears in the middle of an ordinary task and asks the user to do something that feels routine.

Press these keys. Paste this command. Drag this link into the browser. Approve access. Sign in again.

That is the common thread running through ClickFix and a newer Microsoft 365 technique known as ConsentFix. Both exploit familiar digital habits. Instead of forcing their way through a technical weakness, the attackers place a believable instruction in front of someone who is trying to get on with their work.

They are, in effect, attacks on the workflow.

The ‘fix’ that runs the attack

ClickFix is not one piece of malware. It is a method used to deliver malware by persuading the victim to run the attacker’s command for them.

The lure is often a fake CAPTCHA, browser warning, document error or verification screen. It may imitate Cloudflare, Microsoft, Google Chrome or another service the user already recognises. The page claims that something has gone wrong, then offers a short set of instructions to put it right.

On a Windows computer, that can mean pressing the Windows key and R, pasting a command into the Run box and pressing Enter. In some versions, the malicious command has already been copied silently to the clipboard. The user believes they are completing a technical check. In reality, they are launching code supplied by the attacker.

Microsoft’s analysis of ClickFix describes fake verification pages that copy commands to the clipboard and then guide the victim through running them. Those commands can call legitimate Windows tools such as PowerShell to download or execute the next stage of the attack.

That distinction matters. A traditional security message tells people not to open strange files. ClickFix may not present an obvious file at all. It turns the user into the final step of the delivery process.

The attacker does not need someone to ignore a flashing red warning. They need someone to follow instructions that look ordinary.

ConsentFix moves the target from the device to the identity

ConsentFix borrows the same social engineering idea but applies it to Microsoft 365 authentication.

The victim may receive a link to a document shared through a familiar platform such as Dropbox or DocSend. The content can appear to lead into a genuine Microsoft sign-in process. At a carefully chosen point, the user is instructed to complete the process manually, for example by dragging a localhost callback link into the browser.

That unusual action is the trap. It can give the attacker the information needed to obtain OAuth access and refresh tokens. Those tokens may provide access to Microsoft 365 services without the attacker having to steal the password or complete MFA in the usual way.

The potential prize is the working account rather than the password itself: email, OneDrive, Teams, SharePoint and any information the user is entitled to reach.

In a report published on 29 June 2026, Huntress described how the ConsentFix method had already been documented on a public Russian-language cybercrime forum. The material reportedly included working code, infrastructure screenshots and a video walkthrough. It also showed how criminals could use information from LinkedIn and other public sources to select targets and make the approach more convincing.

That may be the more important part of the story. A technique does not need to remain technically sophisticated once somebody has turned it into a repeatable set of instructions. It becomes easier to copy, adapt and aim at another business.

Why these attacks feel believable

Most people spend their working day clearing small digital obstacles. They accept cookie notices, complete CAPTCHAs, reopen documents, approve sign-ins and move between cloud services. The prompts are not memorable because they are designed to be passed quickly.

Attackers understand that rhythm. They do not need an employee to behave recklessly. They need someone to be busy, distracted or mildly irritated by a task that has stopped working.

A fake repair instruction is particularly effective because it gives the victim a problem and a solution at the same time. The user is less likely to question the steps when each click appears to move them closer to the document, meeting or message they were expecting.

This is why telling staff simply to “look for suspicious links” is no longer enough. The page may be polished. The brand may be familiar. Parts of the authentication process may even be legitimate. What deserves scrutiny is the action being requested.

MFA has not become pointless

Techniques that steal or misuse tokens often lead to a predictable question: if an attacker can get around MFA, is MFA still worth having?

Yes. Multi-factor authentication remains one of the most useful protections against account takeover. It stops a large number of attacks that rely on stolen or guessed passwords.

What ConsentFix demonstrates is that MFA cannot carry the whole security strategy on its own. Authentication, application consent and active sessions are related, but they are not the same thing. An attacker who tricks a user into authorising the wrong process may be able to work around the point at which a normal MFA challenge would appear.

Microsoft’s own guidance on OAuth abuse recommends limiting user consent, reviewing application permissions, removing unused or over-privileged apps, applying Conditional Access and monitoring activity across email, identity and endpoints. In other words, the answer is not to abandon MFA. It is to support it with controls that can see what happens before and after the sign-in.

Why this matters to smaller organisations

These attacks are sometimes discussed as though they belong in large enterprises with dedicated security teams. The technology they target is not limited to large enterprises.

Small businesses, charities, schools, care providers and professional firms use the same Microsoft 365 services. Their staff share documents, approve apps and work through browser prompts in much the same way. The main difference is often the amount of monitoring behind those accounts.

A smaller organisation may not have somebody reviewing identity alerts, unusual sign-ins or suspicious PowerShell activity throughout the day. A warning that looks inconclusive can sit unnoticed until a customer reports a strange email or a supplier asks why the bank details on an invoice have changed.

One compromised mailbox can be enough to study payment conversations, create forwarding rules, impersonate a member of staff or launch convincing phishing emails from a trusted address. Access to OneDrive or SharePoint can expose contracts, customer records and internal documents. None of that has to look dramatic to become expensive.

What businesses should change now

There is no single setting that stops every version of ClickFix or ConsentFix. The practical response is to reduce the opportunities for the attack to work and improve the chance of detecting it quickly.

Teach the action, not just the appearance

Awareness training should show people the instructions used in real attacks. Staff should be wary when a website asks them to open the Windows Run box, PowerShell or Terminal; copy and paste a command; drag an unusual link into a browser; install software to view a document; or grant unexpected access to an application.

A useful rule is simple: a CAPTCHA should not require somebody to run a command on their computer. A document should not require an improvised technical repair. A sign-in should not ask the user to drag a localhost link between windows.

Review Microsoft 365 app consent

Check who is allowed to approve third-party applications and what permissions those apps can request. Remove old grants that are no longer needed and investigate applications with broad access to mail, files or user data.

Administrator accounts should be kept separate from normal day-to-day work and protected more tightly. Convenience is a poor reason to leave powerful permissions available to every user.

Strengthen identity controls

Use Conditional Access where the Microsoft 365 licence supports it. Move towards phishing-resistant authentication, such as passkeys or security keys, for administrators and other higher-risk accounts. Review sign-in logs and make sure somebody is responsible for investigating unusual locations, unfamiliar devices and suspicious session activity.

Identity monitoring matters because an attacker may be using a real account rather than dropping an obviously malicious file.

Watch the endpoint as well as the account

ClickFix commonly produces behaviour that can be detected on the computer: unusual PowerShell commands, scripts launched from unexpected processes, downloads from unfamiliar infrastructure or legitimate system tools being used in an unusual sequence.

Managed endpoint detection and response can provide visibility that traditional antivirus may miss. When endpoint and identity monitoring are used together, the organisation has a better chance of connecting the suspicious command on a laptop with the unusual Microsoft 365 session that follows.

Prepare for the account compromise

Every organisation using Microsoft 365 should know what happens if an account is taken over. That includes who can revoke active sessions, reset credentials, inspect mailbox rules, review OAuth grants and check what the attacker accessed or sent.

Cloud backup also has a role. It will not remove an attacker from an account, but it can help recover mail and files if data is deleted, encrypted or altered. The response plan should cover both containment and recovery rather than assuming one will take care of the other.

The attack is designed around normal behaviour

ClickFix and ConsentFix matter because they target the gap between security policy and an ordinary working day.

They exploit the habit of clearing prompts quickly, trusting a familiar sign-in screen and following instructions when a document refuses to open. That does not make staff the problem. It means the attacker has designed the incident around normal human behaviour.

The defence should be designed with the same realism. Remove unnecessary prompts and permissions. Train people with examples they may genuinely encounter. Monitor accounts and devices after the click. Keep recoverable copies of cloud data. Make it easy for somebody to report a mistake without fearing a lecture.

Good security does not depend on every employee making the right decision every time. It puts enough protection around them that one rushed click is detected and contained, rather than becoming the start of a very expensive week.