Hackers Stole Your Account (for free)

John Hammond · 15 min

The video walks through ConsentFix, a browser-based variant of ClickFix that abuses the Azure CLI OAuth localhost sign-in flow to take over Microsoft Entra ID accounts without leaving endpoint artifacts. It examines a cybercriminal tutorial for the attack, including the free services used for phishing and token capture, and shows how dark web monitoring can surface such discussions. Viewers will learn why identity-based attacks like this can evade EDR and antivirus.