ConsentFix: Copy‑Paste OAuth Credential Theft

Microsoft Patch Tuesday January 2026
Microsoft released patches for 113 vulnerabilities. This includes one already exploited vulnerability, one that was made public before today and eight critical vulnerabilities.
https://isc.sans.edu/diary/January%202026%20Microsoft%20Patch%20Tuesday%20Summary/32624
Adobe Patches
Adobe released patches for five products. The code execution vulnerabilities in ColdFusion and Acrobat Reader deserve special attention.
https://helpx.adobe.com/security.html
Fortinet Patches
Fortnet patched two products today, one suffering from an SSRF vulnerability.
https://fortiguard.fortinet.com/psirt/FG-IR-25-783
https://fortiguard.fortinet.com/psirt/FG-IR-25-084
ConsentFix: Analysing a browser-native ClickFix-style attack that hijacks OAuth consent grants
Attackers are tricking victims to copy/paste OAUTH URLs, including credentials, to a fake CAPTCHA
https://pushsecurity.com/blog/consentfix