Share this post
ConsentFix represents the next evolutionary step in OAuth-based attacks, specifically targeting Microsoft users by abusing legitimate authentication and authorization flows. Rather than stealing credentials or bypassing multi-factor authentication (MFA), ConsentFix exploits trust, leveraging standard OAuth mechanics to obtain authorization codes and access tokens that effectively hand attackers the keys to Microsoft Entra ID.
ConsentFix can be understood as a direct evolution of earlier ClickFix attacks. Where ClickFix relied on user interaction quirks to extract sensitive values, ConsentFix modernizes the approach by aligning the attack flow entirely with legitimate OAuth behavior. Security researcher John Hammond recently demonstrated an improved variant of this technique. In his demonstration, the attack no longer required users to copy and paste an authorization code. Instead, users could simply drag and drop the code, removing friction, increasing success rates.
Traditional phishing aims to steal usernames and passwords. ConsentFix, by contrast, bypasses credentials entirely. Adversaries exploit trusted authentication flows to obtain access tokens directly. This is commonly achieved through phishing campaigns delivered via email, messaging platforms, or social media. There are also cases where delivery took place directly through advertising links in search queries. Victims are tricked into interacting with malicious OAuth applications or into completing a Device Code Flow that the attacker has already initiated. At no point does the attacker need the victim’s password. MFA does not fail - it succeeds. The problem is that it succeeds on behalf of the attacker.
In OAuth consent abuse, victims are lured into approving rogue applications that request excessive, misleading, or intentionally vague permissions. Once consent is granted, the application receives an access token scoped to those permissions. The flow typically looks like this:
With that token, the attacker can obtain access tokens and make authenticated API calls, often against Microsoft Graph, without further user interaction, credentials, or MFA challenges. This access persists until the token expires or consent is revoked.
Although subtle, ConsentFix does leave detectable traces in logs:
These indicators often appear benign in isolation but become meaningful when correlated.
Reducing the risk of ConsentFix-style attacks requires a shift in defensive priorities. Because these attacks succeed through legitimate user authorization, the most effective control is not technical enforcement alone, but educated human decision-making, reinforced by layered safeguards. Training should emphasize:
Most importantly, treat OAuth tokens as high-value assets. An access token is not “less dangerous” than a password, it is often even more powerful. Technical controls should reduce exposure and limit the impact of mistakes:
ConsentFix highlights a fundamental shift in adversary tradecraft. Attackers are no longer breaking authentication; they are abusing authorization. By operating entirely within legitimate Microsoft Entra ID flows, they achieve stealth, persistence, and scale that traditional phishing struggles to match. Defending against this class of attack requires visibility into OAuth activity, discipline around consent, and a clear understanding that “legitimate” does not always mean “safe.”
Technical controls are essential, but ConsentFix proves that educated employees are your strongest defense. revel8 delivers continuous security awareness training that adapts to emerging threats like OAuth abuse, deepfakes, and advanced social engineering. Transform your workforce from the weakest link into your most powerful security layer.
ConsentFix is an OAuth-based attack that exploits Microsoft's legitimate authentication flows to gain unauthorized access. Attackers trick users into approving malicious OAuth applications or completing Device Code Flows, obtaining access tokens without ever stealing passwords. The attack succeeds because it abuses authorization rather than breaking authentication.
No. ConsentFix bypasses traditional credential theft, so MFA doesn't fail - it actually succeeds on behalf of the attacker. Since the attack operates within legitimate OAuth flows, MFA cannot prevent it. The user authenticates successfully, but unknowingly grants access to an attacker-controlled application.
Look for these warning signs in your logs: unfamiliar OAuth applications requesting consent, newly registered apps with broad permissions, Device Code Flow authentications from unexpected sources, access tokens used from unusual IP addresses or locations, and API activity without corresponding interactive sign-ins. These indicators become meaningful when correlated together.
Traditional phishing steals usernames and passwords. ConsentFix doesn't need credentials at all, it exploits trust in OAuth flows to obtain access tokens directly. This makes it stealthier and more persistent, as attackers gain legitimate-looking access that bypasses most security controls designed to detect credential theft.
Prevention requires both technical controls and user training. Implement admin approval requirements for new OAuth apps, restrict user consent to verified applications, monitor OAuth activity closely, and regularly audit third-party permissions. Most importantly, train employees to treat consent prompts with the same caution as password requests and to escalate any unexpected authorization requests.
