Full Breakdown
New Phishing Attack Technique: ConsentFix Discovered by Push Security
12/12/2025, 1:55:19 AM
Overview of ConsentFix Attack
Push Security has identified a new class of phishing attack named "ConsentFix," which poses a significant threat to Microsoft account security. This browser-based attack allows for full account takeover without the need for password capture or multi-factor authentication (MFA), marking a notable evolution in phishing methods. The attack has already been observed in the wild, affecting multiple Push Security customers.
How ConsentFix Operates
The ConsentFix attack exploits the Azure Command-Line Interface (CLI), a trusted first-party application. Victims are misled into logging into Azure CLI through a manipulated Google Search result that directs them to compromised websites. These sites present a fake Cloudflare Turnstile challenge, and if the victim is already logged into Microsoft, they are redirected to a localhost URL containing an OAuth authorization code. The final step involves the victim pasting this URL back into the phishing page, thereby granting malicious consent.
This method is particularly concerning because it bypasses traditional phishing defenses. Jacques Louw, Chief Product Officer at Push Security, emphasized that the attack is sophisticated, as it does not require users to provide credentials or MFA codes. Instead, users are tricked into pasting a URL, which can lead to full access to their accounts.
Challenges for Security Teams
The ConsentFix attack presents several challenges for security teams. Since it targets a first-party application like Azure CLI, many standard security controls that apply to third-party applications do not apply here. Azure CLI can request extensive permissions without administrative approval and is exempt from various tenant-level consent restrictions, making it a highly valuable target for attackers.
Louw noted, “ConsentFix completely sidesteps the traditional defenses that companies rely on.” The attack's design allows it to evade detection, complicating the investigation process for security professionals.
Recommendations for Organizations
To mitigate the risks associated with ConsentFix, organizations are advised to monitor for unusual Azure CLI login events, particularly from standard users. It is also recommended to enable and monitor Azure Active Directory (AAD) Graph Activity Logs to detect any unusual activities, such as Active Directory enumeration.
Push Security warns that attackers may integrate ConsentFix into phishing kits, potentially expanding its reach beyond Microsoft to other cloud ecosystems.
Verbatim Quotes
- “This technique is incredibly sophisticated,” — Jacques Louw, Chief Product Officer, Push Security
- “ConsentFix completely sidesteps the traditional defenses that companies rely on,” — Jacques Louw, Chief Product Officer, Push Security
Conclusion
The emergence of the ConsentFix phishing attack underscores the evolving threat landscape in cybersecurity. As attackers develop more sophisticated techniques that exploit trusted applications, organizations must remain vigilant and adapt their security measures accordingly. For further insights and detailed recommendations, Push Security has published a full research report on their blog.
