Loading story…
A new phishing technique called ConsentFix has emerged, targeting Microsoft account users by exploiting the Azure CLI OAuth authentication flow. Discovered by Push Security, this attack is a sophisticated evolution of the earlier ClickFix scam, leveraging social engineering to trick victims into providing OAuth 2.0 authorization codes. Attackers compromise legitimate websites that rank highly in Google search results, presenting visitors with a fake Cloudflare CAPTCHA widget that requests a business email address. If the email matches a target list, the victim is guided through a process that mimics legitimate Microsoft login procedures, ultimately leading them to open a real Microsoft URL and copy a URL containing an OAuth token.
Unlike previous ClickFix attacks that required users to execute malicious commands on their devices, ConsentFix operates entirely within the browser, making it harder for traditional endpoint security tools to detect. By capturing the OAuth token, attackers gain full access to the victim's Microsoft account via the Azure CLI, bypassing both passwords and multi-factor authentication (MFA). This method circumvents email-based anti-phishing controls and highlights the growing sophistication of consent phishing attacks targeting cloud authentication mechanisms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By early March 2026, a public Russian cybercrime forum had posted a step-by-step ConsentFix playbook including code, screenshots, and a video walkthrough. The publication lowered the barrier for other criminals to replicate the Microsoft OAuth account hijacking technique.
Following disclosure of ConsentFix, defenders were urged to watch for unusual Azure CLI login activity and use of legacy Microsoft Graph scopes as possible indicators of compromise. This guidance was published alongside the initial reporting on the attack.
On publication of the research, details emerged showing victims are lured to compromised websites, asked for a business email, guided through a legitimate-looking Azure CLI OAuth flow, and then tricked into pasting back a URL containing the authorization code. The reporting also noted the campaign is highly targeted, filters out non-targets, and triggers only once per victim IP.
Researchers at Push Security identified a new phishing variant dubbed ConsentFix that abuses the Azure CLI OAuth application to take over Microsoft accounts without stealing passwords or bypassing MFA directly. The attack relies on social engineering to obtain an OAuth 2.0 authorization code from the victim.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcehuntress.com
Open sourcebleepingcomputer.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified a new phishing technique called **ConsentFix** that enables attackers to compromise cloud accounts by exploiting legitimate OAuth consent flows. Instead of stealing passwords or MFA codes, the attack relies on social engineering to trick users into copying and pasting a valid Microsoft sign-in URL, which contains an OAuth authorization code, back into a phishing page. This allows threat actors to capture OAuth authorization codes and access tokens, granting them full access to the victim's cloud account without credential exposure. The attack specifically targets users by requiring a matching email address and leverages trusted authentication infrastructure, making detection more challenging for organizations relying on cloud services. The ConsentFix method is similar to the previously documented ClickFix technique, which used fake CAPTCHA pages, but it innovates by harvesting tokens directly through the OAuth process. The phishing flow involves a Cloudflare-style verification prompt, targeted email validation, and redirection to a legitimate Microsoft login page. After successful authentication, the victim is instructed to paste a localhost URL containing the authorization code into the phishing site, enabling the attacker to hijack the session. This technique poses a significant risk to organizations using cloud platforms, as it bypasses traditional credential theft defenses and exploits the inherent trust in OAuth authentication flows.
Jun 29, 2026
Researchers reported a new phishing technique, **ConsentFix v3**, that targets Microsoft Azure accounts by abusing the OAuth2 authorization code flow and trusted first-party Microsoft applications. The attack sends victims through a legitimate Microsoft sign-in process, then tricks them into pasting or dragging a localhost redirect URL containing an authorization code back into a phishing page. Attackers can then exchange that code for tokens, enabling access to Microsoft resources such as email and files without needing the victim’s password and even when MFA is enabled. The latest variant expands on earlier ConsentFix methods by adding automation and scale through third-party services including **Cloudflare Pages** for phishing infrastructure and **Pipedream** for capturing authorization codes, exchanging them for refresh tokens, and collecting stolen tokens; reports also noted use of platforms such as **DocSend**. The technique also incorporates tenant enumeration and employee impersonation to improve targeting. Defenders were advised that mitigation is challenging because trust in Microsoft first-party apps is built into the architecture, but measures such as token binding, behavioral detections, and restricting app authentication can reduce exposure. Researchers said ConsentFix-style attacks have appeared in real campaigns, although widespread adoption of the v3 variant has not yet been confirmed.
Jun 29, 2026
A new phishing technique called **ConsentFix** has emerged, targeting Microsoft Entra ID by abusing legitimate OAuth 2.0 authorization flows. Attackers craft malicious login URLs and use social engineering tactics—such as fake CAPTCHAs or error messages—to trick users into providing OAuth authorization codes. These codes are then exchanged for access and refresh tokens, granting attackers programmatic access to Microsoft accounts and cloud resources, all without stealing credentials or triggering multi-factor authentication (MFA) prompts. The attack is an evolution of previous consent phishing and ClickFix-style methods, with recent variants making the process even easier for victims through drag-and-drop functionality. ConsentFix is particularly dangerous because it bypasses Conditional Access policies and device compliance requirements, undermining otherwise robust security frameworks. Detection and response require visibility into identity, SaaS, and cloud activity, as traditional prevention mechanisms are ineffective. Security teams are advised to monitor Azure sign-in logs for unusual authentication events and to educate users about the risks of interacting with suspicious login flows or error messages that request manual actions like copying and pasting URLs. The attack highlights the ongoing evolution of phishing tactics targeting cloud authentication systems and the need for advanced monitoring and user awareness.
Jun 29, 2026