ConsentFix (2026): Microsoft 365 OAuth phishing that hides its lures on Dropbox and DocSend

ConsentFix abuses Microsoft 365's OAuth consent flow rather than stealing a password outright. Security Boulevard's reporting states that "the original ConsentFix was documented by Push Security in December 2025 as an OAuth phishing technique that tricks victims into pasting a localhost URL containing an OAuth authorization code into an attacker-controlled page," with a second version replacing copy-paste with drag-and-drop before a third, automated version began circulating on hacker forums by around March 2026. Huntress, writing on 29 June 2026, described the same mechanic from the victim's side: "You click through, see what looks like a legitimate Microsoft sign-in experience, and are told to finish the process manually by dragging a localhost callback link into the browser." Because the victim completes a real Microsoft sign-in, including any MFA challenge, before that final drag-and-drop step, the technique captures a live OAuth token rather than a password — Microsoft's own multi-factor authentication is not defeated so much as sidestepped after it has already succeeded.

Dropbox and DocSend (a Dropbox company since 2021) both surface as delivery infrastructure in this reporting, not as the vulnerability being exploited. Huntress wrote that "the attacker sends a phishing lure, often using trusted platforms like Dropbox or DocSend. The content may even be password-protected, which makes it harder for security tooling, like antivirus software, to inspect." Decryption Digest, reporting independently on 4 July 2026, described the same pattern: "Victims receive phishing messages delivered through trusted platforms including Dropbox and DocSend to bypass enterprise email security filters." Two earlier, independent write-ups name DocSend specifically rather than Dropbox: Security Boulevard (Evan Rowe, 3 May 2026) reported that attackers "embed malicious links inside PDFs hosted on DocSend to improve credibility and bypass spam filters," and ThreatAft (4 May 2026) reported that attackers "host phishing pages on Cloudflare Pages, send emails via DocSend, and automate token exchange via Pipedream — all legitimate platforms," adding that "network-level blocking of 'malicious domains' is ineffective" against infrastructure built entirely on legitimate services. In every one of these accounts, the asset being spent is the platforms' own reputation: a link on dropbox.com or docsend.com carries a trust that a link on an unknown domain does not, and a password-protected file is one that automated scanners cannot open to inspect. This is reporting on third parties abusing Dropbox's and DocSend's hosting to deliver lures — none of the sources reviewed describe a vulnerability in Dropbox's or DocSend's own systems.

This archive found no statement from Dropbox or DocSend addressing ConsentFix specifically in the sources reviewed. That silence follows a pattern already documented elsewhere in this archive: phishing pages hosted on Dropbox's own infrastructure (see the 2024-bec-phishing-pages-hosted-on-dropbox entry), Dropbox links used for malware delivery (2024-dropbox-links-malware-delivery), and a recurring pattern of Dropbox-branded impersonation phishing (dropbox-impersonation-phishing-recurring) — each case where the platform's legitimacy is what attackers are actually buying, and each one met with no dedicated public Dropbox statement found by this archive.