Verified X ad, fake Mac app, and the ConsentFix token trick

Two campaigns doing the rounds this week are a decent reminder that attackers have largely stopped bothering with clever exploits. Why break in when the user will happily open the door for you?

The verified ad that wasn't

The first showed up as a sponsored post on X, from a verified account, promoting DynamicLake. That's a real and genuinely popular macOS utility that turns the MacBook notch into something resembling Apple's Dynamic Island. Click the ad and you were sent to dynamicmacisland[.]com, a convincing lookalike site that walked you through opening Terminal and pasting a command to finish the install.

What actually installed was Atomic Stealer, an infostealer with several variants in circulation. This is the ClickFix pattern in a nutshell: the victim runs the malware themselves, which means most endpoint tools never really get a look in. The ad has since been pulled, but the combination of paid placement, a blue tick, and a lookalike domain is a nasty one to defend against with instinct alone.

ConsentFix: no malware required

The second campaign is arguably more dangerous, because it skips malware entirely. It's being called ConsentFix.

A phishing email points to a link, often hosted somewhere trusted like Dropbox, and sometimes password-protected to duck automated scanning. The victim lands on what looks like a normal Microsoft sign-in page and is asked to drag a localhost callback link into their browser to complete sign-in. That drag hands session tokens straight to the attacker.

• No password typed.
• No MFA prompt triggered.
• No file downloaded.
• Full access to the Microsoft 365 account.

One researcher summed it up neatly: ClickFix turns the user into the installer, ConsentFix turns the user into the identity provider. And because the method is now being traded on Russian-language cybercrime forums, the barrier to running one of these campaigns has dropped considerably.

What ties them together

Both stories point in the same direction. A verified badge and a paid ad slot are not vetting. Session tokens are worth as much as passwords and are far easier to steal quietly, because none of the usual signals fire when they change hands. And any instruction that ends with just paste this into Terminal or drag this link into your browser to continue should earn a long pause before the next click, regardless of how legitimate the surrounding site looks.

The technical bar to pull off either attack is low. The human bar, unfortunately, is exactly where the attackers want it.