Hackers Stole Your Account (for free)

Item: Hackers Stole Your Account (for free)
Rating: 4
Author: PostSingularity Institute

by John Hammond

Applied Sciences & Engineering Computing & Cybersecurity URComputer security URHComputer fraud and hacking

🎙 John Hammond 👥 2.2M 📅 April 23, 2026 ⏱ 14 min 👁 24K 📄 expert opinion 🧭 2026-08-16

Available in: English (current) Français

Keywords

ConsentFixOAuthPhishingDark WebThreat Intelligence

Summary

In this video, John Hammond discusses the ConsentFix attack technique, a browser-based phishing method that abuses legitimate OAuth flows to steal credentials and access tokens. He explains how it differs from traditional ClickFix attacks, which target endpoints and leave artifacts detectable by EDR. ConsentFix operates entirely within the browser, making it invisible to endpoint defenses. Hammond demonstrates how threat actors are already discussing and sharing tutorials on this technique on dark web forums, using Flare’s threat intelligence platform to search for mentions. He shows a cybercriminal’s video tutorial that outlines the attack chain, including the use of services like Tutanota, Dropbox DocSend, and Cloudflare Workers. The video emphasizes the growing trend of identity-based attacks and the need for browser-focused security measures. Hammond also highlights the importance of monitoring dark web for exposed credentials and using tools like Flare to protect organizations.

141 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable insights into a relatively new and sophisticated attack technique. Hammond explains the technical details clearly, making it accessible to a broad audience. He supports his claims with real-world examples from dark web forums and a demonstration of the attack. The argumentation is solid, but the heavy promotion of Flare could be seen as biased. However, the core information about ConsentFix is well-researched and presented.

Scientific Rigor, Source Quality, Title Accuracy

Hammond references Push Security’s research on ConsentFix and uses Flare to show real dark web discussions. The sources are credible and relevant. The title accurately reflects the content, though it is somewhat sensational. The video includes a sponsored segment for Flare, which is disclosed. Overall, the scientific rigor is good, but the reliance on a sponsor’s tool for demonstration may affect objectivity.

145 words

Title / Content Match

The title is catchy and accurate, reflecting the content about account theft via ConsentFix attacks.

Quality & Reliability

8/10

The video is presented by a well-known cybersecurity educator and practitioner. It discusses a real attack technique (ConsentFix) with references to industry research (Push Security) and demonstrates dark web monitoring using Flare. The information is current and relevant, but the video includes promotional content for Flare, which may introduce bias. The technical details are accurate and well-explained, but the reliance on a single sponsor's tool for demonstration could affect objectivity.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Flare - Threat Intelligence Platform — Used to demonstrate dark web monitoring and search for ConsentFix mentions.
Push Security - Browser Security — Referenced as the source of the ConsentFix research.
Just Hacking Training — Mentioned as a resource for learning cybersecurity.
CodeCrafters — Mentioned as a resource for learning to code.
OpenVPN — Mentioned as a resource for hosting a VPN.
CyberDefenders — Mentioned as a resource for blue team training and SOC certifications.
InfoSec Map — Mentioned as a resource for cybersecurity events.
Newsletter — Mentioned as a way to stay updated.

Concurring Sources

Push Security - ConsentFix Research — Original research on ConsentFix, likely the primary source for the technique.
MITRE ATT&CK - Phishing — Framework for understanding phishing techniques, including ConsentFix.

Dissenting Sources

No discordant sources found — The video does not present conflicting information; it aligns with known cybersecurity research.

Contribution & Novelties

This video provides a unique perspective on the ConsentFix attack by showing real dark web discussions and a cybercriminal’s tutorial, which is rarely seen in mainstream cybersecurity content. It highlights the shift from endpoint-based to identity-based attacks and emphasizes the importance of browser security. The demonstration using Flare adds practical value for viewers interested in threat intelligence.

Pour aller plus loin :

OAuth 2.0 Authorization Framework — Official RFC explaining OAuth 2.0, relevant to understanding the OAuth abuse in ConsentFix.
Phishing — Overview of phishing techniques, including social engineering aspects.
Threat Intelligence — Definition and importance of threat intelligence in cybersecurity.
Living Off the Land Attacks — MITRE ATT&CK technique related to using legitimate tools for malicious purposes.

118 words

Radar Profile

The radar profile shows high scores in information quantity, quality, and reliability, with a slightly lower technical level. This indicates a well-informed video that is accessible to a broad audience, though it may not delve into the most advanced technical details.

Reliability 8/10

💬 Sur les 0 commentaires analysés, aucune tendance n'a pu être dégagée.