ConsentFix: Browser-native ClickFix hijacks OAuth grants

ConsentFix is a new, highly evasive browser-based phishing technique that hijacks OAuth consent grants—bypassing passwords, MFA, and traditional security controls—by tricking users into pasting legitimate authorization codes into attacker-controlled pages, granting full account access without ever touching the endpoint.