Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake Video-Conference Lures Bypass MFA and Security Awareness Training — Threadlinqs Intelligence
As of 2026-09-01, Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake Video-Conference Lures Bypass MFA and Security Awareness Training is a medium-severity phishing threat attributed to multiple PhaaS affiliates operating the EvilTokens device-code phishing kit, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-2280 · Severity: MEDIUM · Status: ACTIVE · Category: PHISHING
Attribution: multiple PhaaS affiliates operating the EvilTokens device-code phishing kit · FINANCIAL
Huntress documents five evolved phishing techniques — ClickFix, Browser-in-the-Browser, OAuth Consent Phishing (ConsentFix), Device Code Phishing (now packaged as the EvilTokens phishing-as-a-service
This threat covers a family of five phishing tradecraft techniques documented by Huntress on 2026-08-28 and independently corroborated by vendor and community research through 2026. All five share a common defense-evasion logic: instead of delivering a malicious binary or a spoofed password page that trips static detection and trained user suspicion, they weaponize legitimate system components and legitimate identity-provider infrastructure so the victim performs the compromising action themselves.
ClickFix presents a fake CAPTCHA/verification overlay that instructs the victim to press Win+R, Ctrl+V, and Enter, silently executing an attacker-supplied command pasted from the clipboard directly in the native Run dialog or terminal — MITRE formalized this as T1204.004 (User Execution: Malicious Copy and Paste) in March 2025. Independent reporting (The Hacker News, January 2026) documents a live ClickFix variant abusing the signed Microsoft App-V script SyncAppvPublishingServer.vbs as a LOLBin to proxy execution of the Amatera Stealer, and a related ClearFake variant — which retrieves its configuration from Google Calendar ICS files and Binance BNB Smart Chain smart contracts as blockchain-based 'dead drop resolvers' (EtherHiding) — tied to roughly 147,521 infected systems since August 2025 delivering Lumma Stealer and the Emmenhtal/PEAKLIGHT loader.
Browser-in-the-Browser (BitB), first published by researcher mr.d0x in 2022, fabricates an entire fake browser pop-up (padlock, address bar, forged URL) in HTML/CSS/JS inside a legitimate page to spoof SSO login windows for Google, Microsoft, Facebook, and Apple; it defeats exactly the URL/padlock-checking behavior security-awareness training instills, and is detectable because a rendered DOM element cannot be dragged outside the browser viewport.
OAuth Consent Phishing / ConsentFix, first documented by Push Security on 2025-12-11, combines ClickFix-style drag-and-drop social engineering with theft of a live Microsoft Entra ID OAuth authorization code: the victim is tricked into copying a redirect URL (generated via a legitimate sign-in to a trusted first-party app, observed in the wild abusing Azure CLI's client ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46) and pasting it into attacker infrastructure, which extracts the authorization code and redeems it directly against the Microsoft token endpoint for access and refresh tokens — no password or MFA prompt is shown to the victim as suspicious, because they completed real authentication against real Microsoft infrastructure.
Device Code Phishing abuses the OAuth 2.0 Device Authorization Grant (designed for input-constrained devices) by directing victims to the legitimate microsoft.com/devicelogin page and having them enter an attacker-generated code; because authentication happens on genuine Microsoft infrastructure and completes MFA normally, the victim has no way to see that the resulting token is bound to the attacker's device rather than their own. Microsoft attributed sustained use of this technique since August 2024 to STORM-2372 (moderate-confidence Russia nexus), which by February 2025 had escalated to abusing the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register actor-controlled devices in Entra ID, then used the resulting session to conduct Graph API email harvesting and pivot laterally via intra-organizational phishing sent from compromised accounts. The technique has since been productized: Sekoia documented EvilTokens in March 2026, a turnkey Microsoft/Google device-code phishing kit sold as Phishing-as-a-Service via a private Telegram channel (~280 subscribers, $1,500 one-time + $500/month base tier) with a REST backend (/api/device/start, /api/device/status, /api/prt/convert, /api/prt/cookie, /api/prt/recon, /api/prt/azure, /api/prt/owa-session) that converts stolen refresh tokens into Primary Refresh Tokens and browser SSO cookies, performs Graph API and Azure reconnaissance, and was
Target sectors: government administration, finance, health, technology, defense, telecoms, education, energy, transport, professionalservices
Target regions: North America, Europe, Africa, Middle East, Asia, Oceania
Timeline
- Storm-2372 begins a sustained device-code phishing campaign against government, NGO, IT, defense, telecom, healthcare, education, and energy targets across Europe, North America, Africa, and the Middle East, per Microsoft Threat Intelligence.
- Microsoft Threat Intelligence publishes 'Storm-2372 conducts device code phishing campaign,' warning that the actor shifted to abusing the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register attacker-controlled devices in Entra ID.
- Push Security first documents ConsentFix, combining ClickFix-style drag-and-drop social engineering with theft of a Microsoft Entra ID / Azure CLI OAuth authorization code to obtain MFA-bypassing access and refresh tokens.
- The Hacker News reports an expanded ClickFix campaign abusing the signed Microsoft App-V script SyncAppvPublishingServer.vbs to deliver Amatera Stealer, alongside a related ClearFake variant tied to roughly 147,521 infected systems since August 2025.
- A fake Zoom waiting-room site at uswebzoomus.com begins silently installing a stealth-mode Teramind monitoring agent disguised as a video/audio driver update.
- Malwarebytes reports the fake-Zoom/Teramind campaign publicly, noting roughly 1,437 victims infected in the first 12 days.
- Sekoia publishes research on EvilTokens, a turnkey Microsoft device-code phishing kit sold as Phishing-as-a-Service with roughly 280 Telegram subscribers and over 1,000 live phishing domains.
- Huntress publishes 'EvilTokens and the Rise of AI-Powered Phishing,' documenting a 1,380% surge in device-code phishing attacks between the Jul-Dec 2025 and Jan-Apr 2026 windows.
- Huntress publishes 'Next-Gen Phishing Tactics Users Aren't Ready For,' unifying ClickFix, Browser-in-the-Browser, ConsentFix, Device Code Phishing/EvilTokens, and fake video-conference driver-update lures, citing Managed Phishing simulation data showing one-third of learners who clicked a fake meeting link also downloaded a fake driver.
Detections & IOCs
As of 2026-09-03, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
PHISHING, MEDIUM, threat intelligence, cybersecurity, T1566.002, T1204.004, T1204.002, T1059.001, T1059.005, T1216, T1684.001, T1027, T1550.001, T1528
