Quick Summary
In December, the Push Security research team identified a new phishing technique called ConsentFix that targets Microsoft accounts by hijacking OAuth authorization codes. This attack exploits compromised websites to deliver malicious payloads, allowing attackers to bypass traditional security measures like passwords and multi-factor authentication. The campaign is linked to Russian state-affiliated APT29 and has implications for organizations relying on Microsoft services due to its ability to evade detection.
The Securityish Brief
In December, the Push Security research team discovered and blocked a new attack technique named ConsentFix, which combines ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. This technique was identified while monitoring a large network of compromised websites, indicating a widespread campaign affecting multiple customer estates.
The ConsentFix attack prompts victims to share an OAuth authorization code through a phishing page, allowing attackers to bypass identity-layer controls like passwords and multi-factor authentication. This method poses a significant risk as it can target first-party Microsoft applications, which cannot be restricted like third-party applications.
ConsentFix exploits legacy scopes that evade detection and targets known Conditional Access policy exclusions, meaning default security controls may not apply. The attack was linked to Russian state-affiliated APT29, consistent with stealthy tactics observed in previous campaigns.
Within days of the initial discovery, security researchers, including John Hammond and Glueck Kanja, shared improved versions and analyses of the ConsentFix technique, highlighting its rapid evolution and potential for further adoption by both red teams and criminals.
In total, 11 first-party Microsoft applications were identified as vulnerable to ConsentFix, including Microsoft Azure CLI, Microsoft Teams, and Visual Studio. This broad range of targets underscores the need for organizations to enhance their monitoring and detection capabilities.
Push Security intercepted the attack before it could affect customers, utilizing behavioral threat detection controls powered by deep browser telemetry. This approach allows for real-time detection and blocking of browser-based attacks, which are increasingly difficult to identify with traditional security tools.
Implications for Organizations
Organizations must prioritize monitoring controls and mitigations against ConsentFix and similar attacks. Given that this technique operates entirely within the browser context, traditional security measures may be insufficient.
Security teams should implement monitoring of browser activities, hunt for signs of malicious behavior, and ensure that they are not solely relying on Microsoft logging as their defense. Community-created detection rules and guidance can provide additional resources for enhancing security posture against this evolving threat.
Key Takeaways
- Monitor browser activity for signs of phishing attempts, especially targeting OAuth authorization codes.
- Review and enhance Conditional Access policies to cover vulnerable Microsoft applications.
- Implement behavioral threat detection controls to identify browser-based attacks in real-time.
- Stay updated with community resources and detection rules for emerging threats like ConsentFix.
- Educate users about phishing tactics and encourage vigilance when prompted for OAuth codes.
Key Terms & Concepts
- ConsentFix: In this article, ConsentFix refers to a new phishing technique that hijacks OAuth authorization codes to compromise Microsoft accounts.
- OAuth: OAuth is an open standard for access delegation commonly used for token-based authentication and authorization.
- APT29: APT29 is a Russian state-affiliated advanced persistent threat group known for its stealthy cyber operations.
- Conditional Access: Conditional Access refers to policies that control access to applications based on specific conditions, such as user location or device state.
- Behavioral threat detection: Behavioral threat detection is a security approach that analyzes user interactions with applications to identify potential malicious activities.
Read the original article here: https://www.bleepingcomputer.com/news/security/consentfix-debrief-insights-from-the-new-oauth-phishing-attack/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
