ConsentFix is a browser-native OAuth phishing technique that hijacks legitimate Microsoft first-party sign-in flows to steal authorization codes and tokens, enabling stealthy account takeover and persistent cloud access without capturing passwords or triggering MFA.
Overview
ConsentFix is a newly observed, browser-native OAuth phishing technique that compromises Microsoft accounts without stealing passwords. Victims are lured to a malicious or compromised website that uses ClickFix-style prompts to trick them into completing a legitimate Microsoft sign-in for a trusted first-party app, then copying and pasting a localhost redirect URL containing an OAuth authorization code back to the attacker’s page. That single copy/paste step gives the attacker what they need to complete the OAuth handshake on their own device and obtain tokens, enabling account takeover. Because it abuses the authorization flow rather than credentials, it can bypass MFA and even phishing-resistant sign-in methods when the user is already logged into Microsoft in their browser. The campaign has been observed at scale across many compromised, high-reputation sites discovered through search results, and it uses selective targeting and anti-analysis checks to evade automated scanning and frustrate investigation. The net effect is a low-friction, hard-to-detect path to cloud access that can blend into normal login activity while enabling follow-on actions across Microsoft services.
Key Findings:
- ConsentFix enables Microsoft account takeover without stealing passwords or defeating MFA, by hijacking the OAuth authorization process and abusing legitimate sign-in flows for trusted first-party Microsoft applications. This breaks the assumption that MFA or phishing-resistant authentication alone prevents account compromise.
- The attack operates entirely inside the browser and identity layer, using compromised high-reputation websites and ClickFix-style prompts to socially engineer users into handing over OAuth authorization codes, leaving no malware, payloads, or obvious endpoint indicators.
- Targeting first-party Microsoft applications is central to the technique, as these apps are pre-consented, broadly trusted, and often excluded from restrictive Conditional Access policies, allowing attackers to obtain powerful access tokens that blend into normal activity.
- State-aligned threat actors, assessed to include APT29, are actively using or evolving this technique, and rapid community replication shows it is likely to spread to financially motivated groups and access brokers in the near term.
- Successful ConsentFix compromise can lead to persistent, low-visibility cloud access, including access to administrative tooling, collaboration platforms, and sensitive data, with token-based persistence that survives password resets.
- Immediate Actions: Reduce exposure to high-risk first-party OAuth apps by explicitly limiting which users can authenticate to applications such as Azure CLI, PowerShell, and other cloud administration tools. Separate privileged cloud access from routine web browsing, minimizing scenarios in which an existing browser session can be hijacked into an account takeover through a single deceptive interaction.
1.0 Threat Overview
OAuth abuse is not new, but the mechanics and feasibility of “real-world” compromise have shifted as enterprise cloud platforms tightened controls around third-party app consent, risky permission grants, and tenant-wide app governance. Earlier waves of OAuth-focused attacks typically relied on consent phishing, where users were tricked into authorizing attacker-controlled applications to access mail, files, or directory data, or device code phishing, where victims entered a code into a legitimate login page to complete an attacker-initiated sign-in. Those methods remained effective because they exploited user trust in legitimate login pages, but defenders increasingly responded with stricter tenant consent policies, improved app-review workflows, and stronger defaults that reduce the ease with which unknown apps can gain privileges. As these controls became more common, the operational cost of OAuth phishing rose, pushing capable actors to look for pathways that still work even in well-governed tenants.
ConsentFix reflects that next step: rather than asking a user to approve a suspicious third-party app, it leverages trusted first-party Microsoft applications that are widely available and often pre-consented across tenants, thereby removing the friction points that defenders increasingly rely on. The attack also borrows from ClickFix-style lures, using “human verification” prompts and copy-and-paste instructions to guide victims through steps that feel routine and harmless, especially when the login experience looks fully legitimate. This browser-native approach reduces the number of traditional detection opportunities by avoiding payload delivery and credential prompts on the phishing page itself, and by delivering content through compromised websites surfaced via search results instead of email. The technique’s rapid evolution and community replication in late 2025 demonstrated how quickly it can be refined for usability, increasing the likelihood of broader adoption beyond the initial, more selective campaigns. In effect, ConsentFix shows how identity compromise can succeed even when organizations believe they have “phishing-resistant” protections in place, because the attacker is hijacking the authorization process rather than stealing the authentication factor.
1.1 Technique Breakdown
ConsentFix is a multi-stage, browser-native attack that carefully blends social engineering with legitimate OAuth authentication flows to achieve account takeover without ever capturing credentials. Unlike traditional phishing, the attacker does not impersonate a login page or ask for passwords; instead, they guide the victim through actions that appear routine and trustworthy, exploiting how OAuth authorization codes are generated and exchanged by first-party Microsoft applications. The technique is designed to stay entirely within the browser and identity layer, avoiding endpoint artifacts and minimizing the effectiveness of many standard security controls. This technique is particularly dangerous because it reframes the user as an active participant in the compromise while keeping all authentication steps legitimate. The attacker never “breaks” authentication—instead, they redirect it—making ConsentFix difficult to detect, explain to users, and defend against using traditional phishing or endpoint-focused controls.
1.2 Affected Systems
ConsentFix does not target a specific vulnerability in software; instead, it exploits how OAuth authorization is handled across widely used Microsoft identity and productivity services. As a result, the affected “systems” are best understood as identity surfaces, applications, and user populations rather than a single product version. Any organization using Microsoft Entra ID (Azure AD) with standard browser-based access is potentially exposed, particularly where first-party applications and legacy scopes are broadly available.
2.0 Preconditions for Exploitation
ConsentFix succeeds not because of a software flaw, but because certain environmental and behavioral conditions are common in modern Microsoft-based workplaces. The attack relies on normal browser usage, trusted Microsoft authentication flows, and default identity configurations that allow first-party applications to operate with broad access. When these conditions are present, attackers can hijack OAuth authorization without triggering the controls organizations typically rely on to stop phishing or account takeover.
3.0 Threat Actor Utilization
Current intelligence indicates that ConsentFix is being used by highly capable, state-aligned threat actors, rather than opportunistic cybercriminals. Push Security’s analysis, corroborated through collaboration with multiple research teams, assesses with moderate to high confidence that the observed campaign is linked to APT29, a Russian state-affiliated group historically associated with stealthy credential theft, identity abuse, and long-term access operations. The technique aligns closely with APT29’s known preference for low-noise, identity-centric tradecraft that avoids malware deployment and prioritizes persistence through legitimate access paths. Importantly, ConsentFix appears to be an evolution of earlier Russia-linked campaigns that relied on manual social engineering to obtain OAuth authorization material, now refined into a scalable, browser-native approach.
4.0 Historical Exploit Timeline
ConsentFix’s evolution is best understood as a rapid shift from niche OAuth abuse into a repeatable, web-delivered account takeover workflow. The timeline below highlights how earlier “authorization code capture” tactics matured into a scalable campaign delivered through compromised websites, then quickly expanded as researchers identified additional first-party Microsoft applications that could be abused under common enterprise configurations. The speed of iteration matters: once a technique is proven reliable and low-friction, it tends to spread beyond a single actor and becomes a durable part of the phishing playbook.
5.0 Recommendations for Mitigation
5.1 Rapid Containment and Tenant Hardening
- Close the immediate exposure window by prioritizing policy and configuration changes that reduce the ability to complete OAuth-based takeovers, then validate coverage with targeted checks across Entra ID sign-in and audit telemetry.
5.2 Constrain First-Party App Access to “Need-to-Use” Populations
- Create explicit service principals for high-risk first-party apps commonly abused in ConsentFix-style flows (starting with Azure CLI and Azure PowerShell) and limit who can use them to tightly scoped admin and developer groups. This reduces the number of users who can be successfully phished into granting usable tokens, and it prevents broad tenant-wide exposure in which any employee account can be used as an access path to cloud administration.
5.3 Tighten Conditional Access Around OAuth Token Acquisition, Not Just Login
- Re-evaluate Conditional Access assumptions that focus on interactive sign-in alone. Require stronger controls for access to sensitive cloud resources and administrative surfaces, even when the initial authentication is “legitimate,” and explicitly review exclusions that apply to Microsoft first-party apps or legacy resources. The objective is to ensure that obtaining a token is not equivalent to being trusted for high-impact actions.
5.4 Increase Visibility for Legacy and Under-Logged OAuth Activity
- Enable and retain the log sources that capture older and less visible OAuth activity patterns and build a review process around them. ConsentFix’s advantage is that it can leverage legacy scopes and resources that are not highlighted in default monitoring, thereby improving log coverage and retention, which directly reduces dwell time and makes post-compromise validation feasible during incident response.
5.5 Treat High-Risk Browser Paths as an Identity Control Surface
- Reduce exposure to search-driven “watering hole” delivery by tightening controls on how corporate identities are used in everyday browsing. This includes minimizing situations where users are already logged into Microsoft in a general-purpose browser session and separating privileged cloud administration from routine web activity through dedicated, controlled browser profiles or hardened access workstations. This does not rely on endpoint tooling; it reduces the chance that a single deceptive page can convert an existing session into an account takeover event.
5.6 Establish a Playbook for Token-Based Compromise and Rapid Credential Hygiene
- Prepare for the reality that token theft and token replay behave differently from password compromise. Define a response path that includes immediate session invalidation, revocation of refresh tokens, targeted review of app consent and sign-in events, and fast credential rotation for accounts that accessed privileged resources after the suspicious authorization. The goal is to remove attacker-persistence mechanisms that persist after password changes.
6.0 Hunter Insights
ConsentFix-style OAuth phishing will likely drive a broader shift toward identity-layer attacks that bypass passwords and MFA by targeting trusted first‑party cloud applications, browser sessions, and token flows instead of traditional credential theft. As state-aligned groups like APT29 continue operationalizing this technique and security research further documents vulnerable apps and scopes, financially motivated actors and access brokers are expected to adopt copycat variants that weaponize compromised search results and high‑reputation websites to harvest authorization codes at scale, turning OAuth token replay into a common precursor for cloud account takeover and long‑term tenant persistence.
Over the next 12–24 months, defenders should anticipate an arms race around token-centric tradecraft in Microsoft Entra ID: attackers will increasingly chain ConsentFix-style flows with legacy scopes, Conditional Access exclusions, and under-logged first‑party apps to blend into normal administrative activity, while organizations will be forced to re-architect controls around who can reach high‑risk apps, how and where browser sessions are used, and how quickly anomalous OAuth grants and refresh tokens can be detected, revoked, and hunted across cloud environments.
