# Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake Video-Conference Lures Bypass MFA and Security Awareness Training

> Huntress documents five evolved phishing techniques — ClickFix, Browser-in-the-Browser, OAuth Consent Phishing (ConsentFix), Device Code Phishing (now packaged as the EvilTokens phishing-as-a-service kit), and fake Teams/Zoom/Google Meet waiting-room overlays — that abuse legitimate OS tools and cloud auth flows to bypass MFA and defeat static security-awareness training.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2280
- **ID:** TL-2026-2280
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat covers a family of five phishing tradecraft techniques documented by Huntress on 2026-08-28 and independently corroborated by vendor and community research through 2026. All five share a common defense-evasion logic: instead of delivering a malicious binary or a spoofed password page that trips static detection and trained user suspicion, they weaponize legitimate system components and legitimate identity-provider infrastructure so the victim performs the compromising action themselves.

ClickFix presents a fake CAPTCHA/verification overlay that instructs the victim to press Win+R, Ctrl+V, and Enter, silently executing an attacker-supplied command pasted from the clipboard directly in the native Run dialog or terminal — MITRE formalized this as T1204.004 (User Execution: Malicious Copy and Paste) in March 2025. Independent reporting (The Hacker News, January 2026) documents a live ClickFix variant abusing the signed Microsoft App-V script SyncAppvPublishingServer.vbs as a LOLBin to proxy execution of the Amatera Stealer, and a related ClearFake variant — which retrieves its configuration from Google Calendar ICS files and Binance BNB Smart Chain smart contracts as blockchain-based 'dead drop resolvers' (EtherHiding) — tied to roughly 147,521 infected systems since August 2025 delivering Lumma Stealer and the Emmenhtal/PEAKLIGHT loader.

Browser-in-the-Browser (BitB), first published by researcher mr.d0x in 2022, fabricates an entire fake browser pop-up (padlock, address bar, forged URL) in HTML/CSS/JS inside a legitimate page to spoof SSO login windows for Google, Microsoft, Facebook, and Apple; it defeats exactly the URL/padlock-checking behavior security-awareness training instills, and is detectable because a rendered DOM element cannot be dragged outside the browser viewport.

OAuth Consent Phishing / ConsentFix, first documented by Push Security on 2025-12-11, combines ClickFix-style drag-and-drop social engineering with theft of a live Microsoft Entra ID OAuth authorization code: the victim is tricked into copying a redirect URL (generated via a legitimate sign-in to a trusted first-party app, observed in the wild abusing Azure CLI's client ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46) and pasting it into attacker infrastructure, which extracts the authorization code and redeems it directly against the Microsoft token endpoint for access and refresh tokens — no password or MFA prompt is shown to the victim as suspicious, because they completed real authentication against real Microsoft infrastructure.

Device Code Phishing abuses the OAuth 2.0 Device Authorization Grant (designed for input-constrained devices) by directing victims to the legitimate microsoft.com/devicelogin page and having them enter an attacker-generated code; because authentication happens on genuine Microsoft infrastructure and completes MFA normally, the victim has no way to see that the resulting token is bound to the attacker's device rather than their own. Microsoft attributed sustained use of this technique since August 2024 to STORM-2372 (moderate-confidence Russia nexus), which by February 2025 had escalated to abusing the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register actor-controlled devices in Entra ID, then used the resulting session to conduct Graph API email harvesting and pivot laterally via intra-organizational phishing sent from compromised accounts. The technique has since been productized: Sekoia documented EvilTokens in March 2026, a turnkey Microsoft/Google device-code phishing kit sold as Phishing-as-a-Service via a private Telegram channel (~280 subscribers, $1,500 one-time + $500/month base tier) with a REST backend (/api/device/start, /api/device/status, /api/prt/convert, /api/prt/cookie, /api/prt/recon, /api/prt/azure, /api/prt/owa-session) that converts stolen refresh tokens into Primary Refresh Tokens and browser SSO cookies, performs Graph API and Azure reconnaissance, and was observed across roughly 1,000 live phishing domains (Cloudflare Workers subdomains impersonating Adobe/DocuSign/OneDrive/SharePoint, plus self-hosted domains) targeting finance, HR, logistics, and sales staff globally. Huntress's June 2026 EvilTokens report measured a 1,380% surge in device-code phishing volume between the Jul-Dec 2025 and Jan-Apr 2026 windows.

Finally, fake video-conference overlays impersonate Teams/Zoom/Google Meet waiting rooms — complete with loading spinners, scripted fake participants, and (in advanced cases) deepfaked audio/video — culminating in a forced 'driver update' pop-up that delivers a malicious .msi/.scr payload or a hijacked commercial RMM tool. A concrete in-the-wild instance (Malwarebytes, February 2026) used a fake Zoom waiting room at uswebzoomus.com to silently install a stealth-mode Teramind instance (a legitimate workforce-monitoring product misused as spyware — keystroke logging, screenshot capture, clipboard and email/file monitoring with no taskbar/tray/installed-programs presence), infecting roughly 1,437 victims in 12 days. Huntress's own Managed Phishing simulation data shows the pattern's real-world efficacy: over 1,000 learners were caught in the first week of one simulation, and one-third of those who clicked into the fake meeting also clicked 'download driver,' self-compromising.

No CVE applies: every technique abuses legitimate system functionality (Run dialog, signed App-V scripts, OAuth 2.0 device/authorization-code grants, browser DOM rendering, RMM tooling) rather than a software vulnerability, so mitigation is procedural/architectural (Conditional Access restrictions on device-code flow and first-party app usage, phishing-resistant MFA, browser-native detection, and scenario-based training) rather than patch-based.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1216 System Script Proxy Execution
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1550.001 Application Access Token
- T1528 Steal Application Access Token
- T1098.005 Device Registration
- T1087.004 Cloud Account
- T1526 Cloud Service Discovery
- T1114.002 Remote Email Collection
- T1583.006 Web Services
- T1102.001 Dead Drop Resolver
- T1534 Internal Spearphishing

## Sources

- [Next-Gen Phishing Tactics Users Aren't Ready For (Advanced Phishing Tradecraft)](https://www.huntress.com/blog/advanced-phishing-tradecraft)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [New widespread EvilTokens kit: device code phishing as-a-service (Part 1)](https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1)
- [ConsentFix: Browser-native ClickFix hijacks OAuth grants](https://pushsecurity.com/blog/consentfix)
- [ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services](https://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html)
- [Fake Zoom meeting 'update' silently installs unauthorized version of workplace surveillance software](https://www.malwarebytes.com/blog/scams/2026/02/fake-zoom-meeting-update-silently-installs-surveillance-software)
- [EvilTokens and the Rise of AI-Powered Phishing](https://www.huntress.com/resources/eviltokens-ai-powered-phishing-report)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2280