ConsentFix Attack Bypasses MFA, Hijacks Microsoft Accounts via OAuth Phishing

A new and highly effective phishing technique, informally named 'ConsentFix' by the security community, is successfully bypassing password-based authentication and multi-factor authentication (MFA) to hijack Microsoft user accounts. This attack vector represents a paradigm shift, moving from stealing credentials to manipulating the OAuth 2.0 authorization grant flow, a cornerstone of modern single sign-on (SSO) and application integration.

The attack chain begins with a targeted phishing email, SMS, or message designed to create a sense of urgency. The victim is directed to a professionally crafted phishing page that mimics a legitimate Microsoft login screen. Crucially, this page is not designed to harvest usernames and passwords. Instead, it initiates a legitimate OAuth 2.0 authorization request to Microsoft's identity platform (login.microsoftonline.com).

When the user clicks 'Sign in' on this deceptive page, they are redirected to the genuine Microsoft login portal—a detail that often reassures potential victims. The user then enters their credentials and completes any MFA challenge, such as approving a push notification or entering a code from an authenticator app. At this point, traditional security checks are satisfied.

The critical deception occurs next. After successful authentication, Microsoft presents an OAuth consent screen asking the user to grant permissions to an application. The attacker has registered a malicious multi-tenant application in Azure, giving it a convincing name like 'Microsoft Security Suite', 'Company Document Viewer', or another plausible title. The permission request asks for significant access, such as Mail.Read, Calendars.ReadWrite, Contacts.Read, or even User.Read.All.

Most users, having just completed MFA and seeing the familiar Microsoft interface, instinctively click 'Accept' to proceed, believing it is part of a necessary update or integration. By granting consent, the user authorizes the attacker's application to access their Microsoft account data via Microsoft Graph API. Microsoft's platform then issues an authorization code to the malicious application, which is exchanged for an access token and, most importantly, a long-lived refresh token.

This refresh token is the crown jewel for the attacker. It allows them to generate new access tokens independently, maintaining persistent access to the victim's mailbox, OneDrive, calendar, and contacts without ever needing the password or MFA again. The account is effectively owned. The attacker can then use this access for business email compromise (BEC), data exfiltration, lateral movement within an organization, or launching further phishing campaigns from a trusted account.

Why This Attack is Particularly Effective:

1. Bypasses MFA: The user legitimately completes MFA on Microsoft's real site. The attack exploits what happens after authentication.
2. Exploits Trust in UI: Users are conditioned to trust authentication pop-ups from Microsoft. Attackers abuse this trust by presenting a malicious consent prompt immediately after a legitimate login flow.
3. Stealthy and Persistent: No password change is needed, so the victim may not notice any anomaly. Access persists via refresh tokens, which are harder for users to revoke as they are not as visible as active sessions.
4. Difficult to Detect: The initial phishing site may use HTTPS and have a convincing domain. The core of the attack leverages Microsoft's own infrastructure, making it hard for network filters to block.

Mitigation and Defense Strategies:
For end-users and administrators, vigilance is the first line of defense. Users must be trained to treat OAuth consent screens with the same suspicion as login pages. They should carefully review the application name, publisher, and the list of requested permissions before granting access. A request for 'Read all your emails' from an unknown 'Document Viewer' app is a major red flag.

Organizations can take proactive steps:

• Review and Restrict OAuth Apps: Administrators should regularly audit consented applications in the Azure AD portal (Azure Active Directory > Enterprise applications). Suspicious or unnecessary apps should be revoked immediately.
• Implement Conditional Access App Control: Using solutions like Microsoft Defender for Cloud Apps, admins can monitor and control user sessions with third-party apps, blocking access or requiring additional verification for high-risk applications.
• Leverage Tenant Restrictions: For organizations, configuring Azure AD tenant restrictions can prevent users from consenting to applications from untrusted tenants.
• Disable User Consent: In high-security environments, administrators can disable user consent entirely, requiring all application permissions to be reviewed and granted by an IT administrator.
• Enhanced Monitoring: Set up alerts for users granting high-privilege permissions to new or unfamiliar applications.

The 'ConsentFix' conundrum underscores a fundamental truth in cybersecurity: as defenses around one vector (passwords and MFA) harden, attackers will innovate and pivot to exploit others. In this case, they target the psychological and procedural gap between successful authentication and authorized access. Defending against this requires a combination of technical controls, continuous user education, and a proactive security posture that assumes consent prompts can be weaponized.