The article describes how real-world attackers are shifting common breach activity into the web browser, including phishing that steals live sessions, fake “copy/paste to fix” prompts (ClickFix), and OAuth consent/device-code tricks. It highlights how these browser-based lures can bypass MFA and lead to malware installs, account takeover, or session hijacking, often without relying on email.
This breakdown covers a cluster of browser-based attack techniques that shift the classic phishing playbook away from email and into the browser itself. One common pattern is ClickFix: a fake CAPTCHA or verification page tells the user their access needs to be 'fixed,' then instructs them to copy a command and paste it into a terminal or Run prompt. That single copy-paste action runs code locally, often installing remote access tools or infostealer malware without ever touching email security controls.
A related variant, sometimes called InstallFix, uses malvertised fake installer pages for developer tools, replacing the real install command with a malicious one. Another technique, authorization phishing, skips credential theft entirely. Instead of stealing a session from the normal authentication flow, it abuses OAuth consent grants, device code flows, and token exchanges to obtain access tokens directly, including a ClickFix-OAuth hybrid first observed in APT29 activity that has since spread into commodity criminal tooling.
These techniques succeed because they target assumptions defenders rely on. MFA protects the login screen, but session hijacking and reverse-proxy AiTM kits like Tycoon2FA, Sneaky2FA, and Evilginx steal the session token after authentication, making the MFA check irrelevant. OAuth-based tricks work similarly: the user never enters a password on a fake login page, so classic phishing detection misses it. Delivery also matters. Most ClickFix payloads arrive through search engines, compromised sites, malvertising, or SEO poisoning rather than email, and roughly half of all phishing overall is now delivered outside email through messaging apps, social media, SMS, or ads.
Organizations can reduce exposure by training users that verification pages should never require running commands, and that unexpected OAuth consent or device-code prompts deserve scrutiny before approval. Security teams should also address 'ghost logins,' password-based sign-ins that sit outside SSO and remain invisible to identity provider logs, since these accounts stay exposed to credential stuffing even when SSO and MFA are enforced elsewhere. Finally, awareness programs should extend reporting guidance beyond email, since a large share of phishing now arrives through messaging platforms, social media, and malicious advertising.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix lures users with a fake CAPTCHA or verification prompt that instructs them to copy and run a command on their own computer, which typically installs remote access tools or infostealer malware.
Instead of stealing credentials through the normal login flow, authorization phishing abuses OAuth consent grants and device code flows to obtain access tokens directly, so MFA on the login screen never comes into play.
Session hijacking steals the browser token after authentication has already happened, so even strong MFA controls at login do not stop an attacker from reusing that stolen session.
No, the article notes that phishing links are increasingly delivered through instant messaging, social media, SMS, malicious ads, and in-app messaging, not just email.
You’re on a site, a fake CAPTCHA pops up and says your access is broken, “run this command to fix it.” That’s ClickFix: since late 2024, sites and malicious ads have been tricking people into copy‑pasting commands that silently install remote access tools and infostealer malware. Real CAPTCHAs and install pages don’t need you to paste shell commands from the browser. If a “fix” or installer from search results tells you to copy a command into Terminal or Run, assume it’s malware. One rule: if any website tells you to copy and run a command, stop, close the tab, and report the link, no matter whether it came from email, chat, or an ad.
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
Attackers compromised legitimate Ukrainian websites and showed visitors a fake CAPTCHA/Cloudflare-style “verification” prompt to trick them into installing malware. The infection chain drops Lunex (aka Psychedelic Stealer), which disables security monitoring using a vulnerable AMD driver and then…
