Researchers have uncovered a new attack technique called ConsentFix.
It is a browser-native evolution of earlier ClickFix and OAuth consent phishing campaigns.
But this is not just another one-off trick. It is part of a wider shift towards abusing trusted apps, active sessions and normal user behaviour, rather than breaking in the old-fashioned way.
The attacker does not always need to steal a password.
With ConsentFix, the attack abuses Microsoft’s own Azure CLI app. The victim is tricked into copying and pasting a legitimate OAuth authorisation URL, which links the attacker’s Azure CLI session to the victim’s account.
To the person being targeted, it can look harmless.
They may be told to run a quick command, paste a link, connect a tool, complete a setup step, or fix an issue with Microsoft 365.
No fake Microsoft login page.
No stolen password.
Sometimes no obvious MFA warning.
Just a trusted Microsoft app doing what it has been allowed to do.
That is what makes this uncomfortable. Azure CLI is a first-party Microsoft app, so it is trusted by default in Microsoft 365 tenants. The attacker is not trying to smuggle in a strange-looking app with a suspicious name. They are abusing something that already belongs in the Microsoft ecosystem.
ConsentFix is clever, but the lesson is not new.
Weak consent settings, old app permissions and poor visibility make identity compromise far too easy.
What we often see
In Microsoft 365 environments, especially in smaller organisations, we often see the same gaps:
Users are allowed to approve apps without restriction.
Old OAuth connections are still active and have never been reviewed.
Admins do not always know which apps can read email, access files or keep access in the background.
Azure CLI activity is not monitored at all.
MFA is in place, but there is very little visibility of what happens after login.
That last point matters.
MFA is still important. We recommend it. Cyber Essentials requires it in the right places. The DfE expects it for key school accounts.
But MFA does not fix everything.
If an attacker can trick someone into approving access, entering a code on a genuine Microsoft page, or linking a trusted app to their account, the problem moves from “did they know the password?” to “what did the attacker get access to?”
The threat has moved quickly
ConsentFix sits in the same family of attacks as OAuth consent phishing, device code phishing and token theft.
In March 2026, Microsoft reported phishing campaigns abusing legitimate OAuth redirection behaviour. Attackers used normal OAuth functions, crafted links and malicious apps to redirect people through trusted identity flows before sending them to attacker-controlled infrastructure.
In April 2026, Microsoft also reported an AI-enabled device code phishing campaign.
Device code phishing abuses a legitimate Microsoft login process designed for devices where typing a password is awkward, such as TVs, printers and terminals.
The attacker generates a code.
The victim is asked to enter that code on Microsoft’s real login page.
If the victim completes the process, the attacker receives valid access tokens.
No fake login page is needed. The user may complete MFA themselves. From their point of view, they have signed in to Microsoft. From the attacker’s point of view, they now have a live route into the account.
Microsoft said the April campaign used automation, dynamic code generation and personalised lures linked to the victim’s role. These included invoices, RFPs and normal business workflows.
Once access was granted, attackers could move into email, Microsoft Graph, inbox rules and wider reconnaissance.
The FBI has also warned about Kali365, a phishing-as-a-service platform first seen in April 2026. It is distributed mainly through Telegram and is designed to capture Microsoft 365 OAuth tokens. The FBI says it can allow attackers to bypass MFA controls without intercepting the user’s password.
Huntress has since linked device code activity to a wider ecosystem around Kali365 and Octopi365, with phishing templates, token management, billing, role-based access, domain marketplaces and AI-assisted business email compromise features.
In one case observed by Huntress, the attacker gained persistent access in as little as 42 seconds after the victim entered the device code.
That is the direction this is going.
Not just better phishing emails.
Repeatable workflows.
Trusted Microsoft login pages.
OAuth tokens.
Device codes.
Automation.
AI-written lures.
Phishing kits that package the whole thing up for less technical criminals.
For schools, care providers and small businesses, this is the uncomfortable bit: the attack may not look like “hacking” at all. It may look like a normal Microsoft sign-in, a Teams-related request, a document workflow, an invoice query or a support instruction.
What you can do
Even where a new variant abuses a trusted Microsoft app, you can still reduce your exposure.
Start with Microsoft Entra ID.
Turn off user consent for apps
Go to:
Entra ID → Enterprise apps → Consent and permissions → User consent settings
Then select:
Do not allow user consent.
This stops people from approving access to apps without review.
Enable the Admin Consent Workflow
This gives staff a way to request legitimate apps, without allowing every app to be approved on the spot.
It is a sensible middle ground.
People can still ask for tools they need. Admins get the chance to check what the app is, who published it and what permissions it wants.
Audit existing OAuth and CLI activity
Review:
Enterprise applications → User consented apps
Look for apps that are unfamiliar, unused, over-permissioned or no longer needed.
Also review Azure CLI sign-ins.
Azure CLI activity from a non-admin account, an unusual location, or a user who has no reason to use command-line tools should be treated as suspicious.
Review risky OAuth permissions
Pay particular attention to apps requesting permissions such as:
Mail.Read
Mail.Send
Files.ReadWrite.All
offline_access
User.Read.All
Directory.Read.All
These permissions can allow access to email, files, directory data, or long-lived sessions.
The offline_access permission is especially important because it can allow refresh tokens to be issued. That may give the attacker ongoing access even after the initial sign-in has finished.
Watch for device code phishing
Staff should know one simple rule:
Only enter a Microsoft device code if you personally started the sign-in.
If someone sends a code by email, Teams, WhatsApp, SMS or chat and asks you to enter it into a Microsoft page, stop and check.
That message may look like it came from a colleague, IT support, a supplier, a finance contact or a trusted platform.
The page may be genuine.
That does not mean the request is safe.
Review Conditional Access
Where licensing allows, review whether device code authentication should be restricted.
Also look at Conditional Access rules for risky sign-ins, unfamiliar locations, unmanaged devices and impossible travel.
For many small businesses, this is where a Microsoft 365 security review gives real value. The settings are powerful, but they need to be applied carefully. Locking everything down without planning can create problems for staff, mobile devices, shared workflows and emergency access.
These changes help, but they are not magic
Turning off user consent, enabling admin approval and auditing OAuth apps will not stop every version of ConsentFix.
They will close some of the common gaps that make OAuth abuse easier.
They also make it harder for attackers to keep quiet access to Microsoft 365 once they have tricked someone into approving something.
The goal is not perfection.
The goal is to reduce the easy routes in.
Detecting what slips through
Attacks like ConsentFix, device code phishing and OAuth token abuse are difficult because they use trusted services.
Traditional defences may not see a malicious file.
There may be no malware.
There may be no fake login page.
The sign-in may go through Microsoft.
The app may be trusted.
The user may have completed the action themselves.
That is where identity monitoring becomes important.
Huntress ITDR monitors Microsoft 365 and Entra ID for suspicious identity activity, including unusual sign-ins, risky permission changes and OAuth-related events.
It can help spot activity such as:
unexpected Azure CLI logins from non-admin users
new OAuth grants
suspicious consent activity
new inbox rules
changes to role assignments
unusual access after login
It cannot stop someone clicking “Accept” in the browser.
It cannot stop someone entering a device code if they have been tricked.
But it can help alert you when something does not look right, giving you time to act before email is searched, files are accessed, rules are created or business email compromise begins.
That is the point many organisations miss.
The danger is not just the login.
It is what happens next.
Once access is granted, attackers can read email, search files, study conversations, create forwarding rules, impersonate staff, target finance teams, or wait for the right invoice or payment thread.
They may not need the password again.
Why it matters
Identity is now the frontline of cyber defence.
Whether it is a ConsentFix-style hijack, a classic OAuth phish, device code phishing, token theft or a new ClickFix clone, the same message keeps coming back:
Microsoft 365 needs proper identity controls.
That means tighter consent policies.
Regular app reviews.
Better sign-in monitoring.
Clearer staff guidance.
Good backup.
Security awareness training that covers real behaviour, not just fake login pages.
We are seeing more attacks move in this direction.
Not malware.
Not obvious phishing.
Not someone guessing a password.
Convincing actions that people carry out themselves.
Accept this app.
Approve this sign-in.
Enter this code.
Paste this command.
Connect this tool.
Fix this issue.
That is why schools, care providers and small businesses need to treat Microsoft 365 hardening as a practical security priority, not an enterprise luxury.
Black Swan Cyber Security Solutions helps organisations harden Microsoft 365 against real-world threats, combining Entra ID security, Microsoft 365 configuration reviews and Huntress ITDR monitoring so unusual activity is seen and acted on quickly.
Related reads
Attacks like this don’t rely on breaking in. They rely on access, trust, and behaviour. These blogs explore how that plays out in the real world.
They didn’t hack you, they logged in
A closer look at how most modern attacks work using valid credentials, not traditional hacking techniques.
Read this blog →What happens after a phishing click
What actually happens behind the scenes after a user clicks a phishing link and unknowingly gives access.
Read this blog →How modern email security stops attacks before they reach staff
Where attacks usually start, and how modern protection reduces the chance of users ever seeing them.
Read this blog →The most dangerous email doesn’t contain malware
Why the biggest risks now look legitimate, trusted, and often completely harmless on the surface.
Read this blog →
