Threat reportPhishingTL-2026-2280
Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake Video-Conference Lures Bypass MFA and Security Awareness Training
Advanced Phishing Tradecraft (TL-2026-2280), also tracked as ClickFix, is a medium-severity phishing campaign, first published 2026-08-28. It has no confirmed attribution, affects Microsoft Microsoft Entra ID / Microsoft 365 (OAuth 2.0 Device, maps to 17 MITRE ATT&CK techniques (T1027, T1059.001, T1059.005), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-2280
- Threat ID
- TL-2026-2280
- Also known as
- ClickFix, Browser-in-the-Browser, BitB, ConsentFix, Device Code Phishing, EvilTokens
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, health, technology, defense, telecoms, education, energy, transport, professionalservices
- Target regions
- North America, Europe, Africa, Middle East, Asia, Oceania
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Advanced Phishing Tradecraft
Malware and tooling: Amatera Stealer, ClearFake, Emmenhtal Loader (PEAKLIGHT), Lumma Stealer - S1213, Teramind
How Advanced Phishing Tradecraft works
Huntress documents five evolved phishing techniques — ClickFix, Browser-in-the-Browser, OAuth Consent Phishing (ConsentFix), Device Code Phishing (now packaged as the EvilTokens phishing-as-a-service kit), and fake Teams/Zoom/Google Meet waiting-room overlays — that abuse legitimate OS tools and cloud auth flows to bypass MFA and defeat static security-awareness training.
This threat covers a family of five phishing tradecraft techniques documented by Huntress on 2026-08-28 and independently corroborated by vendor and community research through 2026. All five share a common defense-evasion logic: instead of delivering a malicious binary or a spoofed password page that trips static detection and trained user suspicion, they weaponize legitimate system components and legitimate identity-provider infrastructure so the victim performs the compromising action themselves.
ClickFix presents a fake CAPTCHA/verification overlay that instructs the victim to press Win+R, Ctrl+V, and Enter, silently executing an attacker-supplied command pasted from the clipboard directly in the native Run dialog or terminal — MITRE formalized this as T1204.004 (User Execution: Malicious Copy and Paste) in March 2025. Independent reporting (The Hacker News, January 2026) documents a live ClickFix variant abusing the signed Microsoft App-V script SyncAppvPublishingServer.vbs as a LOLBin to proxy execution of the Amatera Stealer, and a related ClearFake variant — which retrieves its configuration from Google Calendar ICS files and Binance BNB Smart Chain smart contracts as blockchain-based 'dead drop resolvers' (EtherHiding) — tied to roughly 147,521 infected systems since August 2025 delivering Lumma Stealer and the Emmenhtal/PEAKLIGHT loader.
Browser-in-the-Browser (BitB), first published by researcher mr.d0x in 2022, fabricates an entire fake browser pop-up (padlock, address bar, forged URL) in HTML/CSS/JS inside a legitimate page to spoof SSO login windows for Google, Microsoft, Facebook, and Apple; it defeats exactly the URL/padlock-checking behavior security-awareness training instills, and is detectable because a rendered DOM element cannot be dragged outside the browser viewport.
OAuth Consent Phishing / ConsentFix, first documented by Push Security on 2025-12-11, combines ClickFix-style drag-and-drop social engineering with theft of a live Microsoft Entra ID OAuth authorization code: the victim is tricked into copying a redirect URL (generated via a legitimate sign-in to a trusted first-party app, observed in the wild abusing Azure CLI's client ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46) and pasting it into attacker infrastructure, which extracts the authorization code and redeems it directly against the Microsoft token endpoint for access and refresh tokens — no password or MFA prompt is shown to the victim as suspicious, because they completed real authentication against real Microsoft infrastructure.
Device Code Phishing abuses the OAuth 2.0 Device Authorization Grant (designed for input-constrained devices) by directing victims to the legitimate microsoft.com/devicelogin page and having them enter an attacker-generated code; because authentication happens on genuine Microsoft infrastructure and completes MFA normally, the victim has no way to see that the resulting token is bound to the attacker's device rather than their own. Microsoft attributed sustained use of this technique since August 2024 to STORM-2372 (moderate-confidence Russia nexus), which by February 2025 had escalated to abusing the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register actor-controlled devices in Entra ID, then used the resulting session to conduct Graph API email harvesting and pivot laterally via intra-organizational phishing sent from compromised accounts. The technique has since been productized: Sekoia documented EvilTokens in March 2026, a turnkey Microsoft/Google device-code phishing kit sold as Phishing-as-a-Service via a private Telegram channel (~280 subscribers, $1,500 one-time + $500/month base tier) with a REST backend (/api/device/start, /api/device/status, /api/prt/convert, /api/prt/cookie, /api/prt/recon, /api/prt/azure, /api/prt/owa-session) that converts stolen refresh tokens into Primary Refresh Tokens and browser SSO cookies, performs Graph API and Azure reconnaissance, and was observed across roughly 1,000 live phishing domains (Cloudflare Workers subdomains impersonating Adobe/DocuSign/OneDrive/SharePoint, plus self-hosted domains) targeting finance, HR, logistics, and sales staff globally. Huntress's June 2026 EvilTokens report measured a 1,380% surge in device-code phishing volume between the Jul-Dec 2025 and Jan-Apr 2026 windows.
Finally, fake video-conference overlays impersonate Teams/Zoom/Google Meet waiting rooms — complete with loading spinners, scripted fake participants, and (in advanced cases) deepfaked audio/video — culminating in a forced 'driver update' pop-up that delivers a malicious .msi/.scr payload or a hijacked commercial RMM tool. A concrete in-the-wild instance (Malwarebytes, February 2026) used a fake Zoom waiting room at uswebzoomus.com to silently install a stealth-mode Teramind instance (a legitimate workforce-monitoring product misused as spyware — keystroke logging, screenshot capture, clipboard and email/file monitoring with no taskbar/tray/installed-programs presence), infecting roughly 1,437 victims in 12 days. Huntress's own Managed Phishing simulation data shows the pattern's real-world efficacy: over 1,000 learners were caught in the first week of one simulation, and one-third of those who clicked into the fake meeting also clicked 'download driver,' self-compromising.
No CVE applies: every technique abuses legitimate system functionality (Run dialog, signed App-V scripts, OAuth 2.0 device/authorization-code grants, browser DOM rendering, RMM tooling) rather than a software vulnerability, so mitigation is procedural/architectural (Conditional Access restrictions on device-code flow and first-party app usage, phishing-resistant MFA, browser-native detection, and scenario-based training) rather than patch-based.
MITRE ATT&CK techniques used in TL-2026-2280
Defense Evasion
T1027 Obfuscated Files or Information; T1216 System Script Proxy Execution; T1684.001 Impersonation
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Discovery
T1087.004 Cloud Account; T1526 Cloud Service Discovery
Persistence
Command and Control
Collection
T1114.002 Remote Email Collection
Credential Access
T1528 Steal Application Access Token
Lateral Movement
lateral-movement
T1550.001 Application Access Token
Initial Access
Resource Development
Affected products and versions in Advanced Phishing Tradecraft
- Microsoft — Microsoft Entra ID / Microsoft 365 (OAuth 2.0 Device Authorization Grant)
Vulnerable versions: Any tenant with the device code flow enabled without Conditional Access restriction
Fixed in: Tenants that block or restrict the device code flow via Conditional Access - Microsoft — Azure CLI (first-party OAuth client, App ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46)
Vulnerable versions: Default configuration: trusted in all tenants, no admin consent required, cannot be deleted or blocked
Fixed in: N/A — mitigated only via Conditional Access restriction and sign-in log monitoring - Google — Google Workspace / Google OAuth device and consent flows
Vulnerable versions: Any tenant with device code / OAuth consent flows enabled
Fixed in: N/A - Microsoft — Windows 10/11 (Run dialog, native terminal, App-V / SyncAppvPublishingServer.vbs)
Vulnerable versions: Windows 10/11 Enterprise/Education with App-V enabled; any Windows build with default Run-dialog access
Fixed in: N/A — social-engineering mitigations and script-block policies required
Remediation for Advanced Phishing Tradecraft
Immediate actions
- Block or restrict the OAuth 2.0 Device Authorization Grant flow via Conditional Access policies wherever it is not a genuine business requirement
- Train users on the ClickFix 'fake CAPTCHA' pattern: legitimate verification never requires Win+R, Ctrl+V, and Enter
- Instruct users to test suspicious SSO/login pop-ups by dragging the window outside the browser viewport — a rendered Browser-in-the-Browser window cannot leave the page canvas
- Enforce 'never enter a device code you did not personally generate' guidance in security awareness training
- Revoke refresh tokens and active sign-in sessions (revokeSignInSessions) for any account suspected of device-code or consent-phishing compromise, and audit for unexpected registered devices in Entra ID
Workarounds
- Disable or tightly scope the device code authentication flow tenant-wide if not required by any legitimate device
- Restrict Azure CLI and other trusted first-party OAuth client usage to designated administrator/developer groups only
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/WebAuthn passkeys) that cannot be relayed through device-code or consent-phishing flows
- Restrict which first-party Microsoft applications (e.g., Azure CLI) can be used interactively by non-administrative users via Conditional Access
- Monitor Entra ID sign-in and Graph API audit logs for anomalous device registrations, non-interactive logins from IPs distinct from the initiating interactive session, and legacy-scope ('Windows Azure Active Directory' resource) usage on Azure CLI sign-ins
- Adopt browser-based detection/isolation tooling capable of identifying in-page BitB/ClickFix/ConsentFix rendering in real time
- Move security-awareness training from static content to interactive, scenario-based simulations that build behavioral muscle memory against these specific techniques
Weaknesses (CWE) in Advanced Phishing Tradecraft
Timeline of Advanced Phishing Tradecraft
- Storm-2372 begins a sustained device-code phishing campaign against government, NGO, IT, defense, telecom, healthcare, education, and energy targets across Europe, North America, Africa, and the Middle East, per Microsoft Threat Intelligence.
- Microsoft Threat Intelligence publishes 'Storm-2372 conducts device code phishing campaign,' warning that the actor shifted to abusing the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register attacker-controlled devices in Entra ID.
- Push Security first documents ConsentFix, combining ClickFix-style drag-and-drop social engineering with theft of a Microsoft Entra ID / Azure CLI OAuth authorization code to obtain MFA-bypassing access and refresh tokens.
- The Hacker News reports an expanded ClickFix campaign abusing the signed Microsoft App-V script SyncAppvPublishingServer.vbs to deliver Amatera Stealer, alongside a related ClearFake variant tied to roughly 147,521 infected systems since August 2025.
- A fake Zoom waiting-room site at uswebzoomus.com begins silently installing a stealth-mode Teramind monitoring agent disguised as a video/audio driver update.
- Malwarebytes reports the fake-Zoom/Teramind campaign publicly, noting roughly 1,437 victims infected in the first 12 days.
- Sekoia publishes research on EvilTokens, a turnkey Microsoft device-code phishing kit sold as Phishing-as-a-Service with roughly 280 Telegram subscribers and over 1,000 live phishing domains.
- Huntress publishes 'EvilTokens and the Rise of AI-Powered Phishing,' documenting a 1,380% surge in device-code phishing attacks between the Jul-Dec 2025 and Jan-Apr 2026 windows.
- Huntress publishes 'Next-Gen Phishing Tactics Users Aren't Ready For,' unifying ClickFix, Browser-in-the-Browser, ConsentFix, Device Code Phishing/EvilTokens, and fake video-conference driver-update lures, citing Managed Phishing simulation data showing one-third of learners who clicked a fake meeting link also downloaded a fake driver.
Sources cited for Advanced Phishing Tradecraft
- Next-Gen Phishing Tactics Users Aren't Ready For (Advanced Phishing Tradecraft)
- Storm-2372 conducts device code phishing campaign
- New widespread EvilTokens kit: device code phishing as-a-service (Part 1)
- ConsentFix: Browser-native ClickFix hijacks OAuth grants
- ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services
- Fake Zoom meeting 'update' silently installs unauthorized version of workplace surveillance software
- EvilTokens and the Rise of AI-Powered Phishing
Detection coverage for TL-2026-2280
As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2280 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2280
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.