ConsentFix Debrief: Insights From The New OAuth Phishing Attack

ConsentFix is not a traditional phishing campaign focused on credential theft. Instead, it leverages social engineering to trick users into granting OAuth delegated permissions to attacker-controlled applications.

By abusing legitimate Microsoft OAuth authorization flows, attackers obtain:

• OAuth authorization codes
• OAuth access tokens
• OAuth refresh tokens

This enables persistent access to cloud resources while avoiding many conventional security detections.

Unlike password-based phishing:

• No credentials are stolen.
• No MFA is bypassed.
• Authentication is legitimately completed by the victim.
• Access is obtained through Microsoft-issued tokens.

This technique has been observed in the wild as an emerging OAuth phishing pattern targeting mailbox, file, and directory access.

The ConsentFix attack unfolds through a sequence of legitimate-looking steps that exploit user trust and OAuth mechanics:

1. User Lure and Initial Interaction
   The victim is redirected to a malicious or compromised webpage that presents a fake verification step, such as a CAPTCHA or “prove you are human” prompt. The page instructs the user to initiate a Microsoft sign-in or OAuth authorization flow.
2. Legitimate OAuth Consent Grant
   The user successfully authenticates with Microsoft and is shown a genuine OAuth consent screen.
   The attacker-controlled application requests delegated permissions, often including high-risk scopes such as:

• • offline_access
  • Mail.Read / Mail.ReadWrite
  • Files.Read / Files.ReadWrite
  • Directory.Read.All

The victim unknowingly grants these permissions.

Why These Scopes Matter

• offline_access: grants refresh tokens, enabling long-term persistence even after access tokens expire.
• Mail.Read / Mail.ReadWrite: enables full mailbox exfiltration, monitoring, or manipulation.
• Files.Read / Files.ReadWrite: allows access to OneDrive and SharePoint documents.
• Directory.Read.All: Enables tenant-wide reconnaissance and privilege mapping.

These permissions often exceed what users expect when clicking “Accept.”

1. Authorization Code Exposure via Social Engineering
   After consent is granted, Microsoft redirects the browser to a local or loopback URI containing an OAuth authorization code. The attacker then socially engineers the user into copying and pasting this URL back into the malicious webpage.
2. Token Redemption by the Attacker
   The attacker redeems the exposed authorization code on their own infrastructure.
   In exchange, Microsoft issues:
   • An access token (typically valid for ~1 hour)
   • A refresh token (can remain valid for up to 90 days by default)
     Because the user authenticated legitimately, this does not trigger:
     • Credential theft alerts
     • MFA bypass alerts
     • Impossible travel alerts (initially)
   • The attacker now holds valid Microsoft-issued tokens.
3. Post-Consent Access and Abuse
   Using the obtained tokens, the attacker performs follow-on activity such as mailbox access, file access, or directory reconnaissance. These actions often appear as legitimate token-based or non-interactive sign-ins within Entra ID logs, making detection challenging.

Why MFA Does Not Stop This Attack

ConsentFix does not bypass MFA.

Instead:

• The user completes MFA legitimately.
• Microsoft issues valid OAuth tokens.
• Conditional Access evaluates the sign-in as compliant.
• Subsequent token-based access does not require reauthentication.

This shifts the security boundary from “Did the user authenticate?” to “What permissions did the user grant?”

The ConsentFix technique aligns with the following MITRE ATT&CK techniques:

To reduce exposure to OAuth phishing attacks such as ConsentFix, organizations should:

• Restrict user consent to applications, especially for high-risk delegated permissions.
• Require admin approval for sensitive OAuth scopes.
• Regularly review existing OAuth app registrations and granted permissions.
• Enforce Conditional Access policies for token-based and non-interactive sign-ins.
• Educate users on OAuth consent risks and social engineering techniques.

Detection of ConsentFix-style activity requires visibility into OAuth consent events and post-consent authentication behavior. Traditional sign-in monitoring alone is insufficient.

Key detection strategies include:

• Monitoring user-initiated OAuth consent grants involving high-risk delegated permissions.
• Identifying consent to unfamiliar or rarely used applications.
• Correlating consent events with sign-in activity within 24 hours, which is the most likely window for attacker token usage.
• Detecting increases in token-based or non-interactive sign-ins following OAuth consent.
• KQL:

  let HuntWindow = 30d; 
  
  let HighRiskScopes = dynamic([ 
  
      "offline_access", 
      "Mail.Read", 
      "Mail.ReadWrite", 
      "Files.Read", 
      "Files.ReadWrite", 
      "Directory" 
  
  ]); 
  
  let ConsentEvents = 
  
      AuditLogs 
      | where TimeGenerated > ago(HuntWindow) 
      | where OperationName has_any ( 
  
          "Consent to application", 
          "Add OAuth2PermissionGrant", 
          "Add delegated permission grant" 
  
      ) 
  
      | extend UPN = tostring(InitiatedBy.user.userPrincipalName) 
      | extend Details = tostring(AdditionalDetails) 
      | where isnotempty(UPN) 
      | where Details has_any (HighRiskScopes) 
      | project 
          ConsentTime = TimeGenerated, 
          UPN, 
          OperationName, 
          TargetResources, 
          AdditionalDetails; 
  
  SigninLogs 
  
  | where TimeGenerated > ago(HuntWindow) 
  | join kind=innerunique (ConsentEvents) 
      on $left.UserPrincipalName == $right.UPN 
  | where TimeGenerated between (ConsentTime .. ConsentTime + 24h) 
  | project 
  
      TimeGenerated, 
      UserPrincipalName, 
      AppDisplayName, 
      IPAddress, 
      Location, 
      ClientAppUsed, 
      UserAgent, 
      Status, 
      ConditionalAccessStatus, 
      ConsentTime, 
      OperationName 
  
  | order by TimeGenerated desc
  
  

If suspicious OAuth consent activity is identified:

• Revoke affected OAuth permissions and refresh tokens immediately.
• Remove or disable malicious or unauthorized application registrations.
• Review audit and sign-in logs for post-consent activity.
• Assess potential data exposure, particularly mailbox and file access.

ConsentFix highlights a broader industry trend toward abusing legitimate identity features rather than exploiting software vulnerabilities. As organizations strengthen MFA and endpoint security, attackers are increasingly targeting OAuth, tokens, and delegated permissions to achieve persistence while blending into normal cloud activity.

• Microsoft Entra ID (Azure AD)
• Microsoft 365 OAuth authorization flows
• Exchange Online
• OneDrive and SharePoint Online
• Microsoft Graph API

ConsentFix demonstrates how attackers can bypass traditional security assumptions by operating entirely within legitimate authentication and authorization mechanisms. Token-based access can persist silently, leading to data exposure, compliance risk, and reputational damage without triggering conventional alerts

This reinforces the need for layered identity visibility and proactive monitoring of OAuth activity

Wizard Cyber helps organizations detect and respond to advanced identity-based threats by combining deep Microsoft security expertise with proactive threat hunting. Our approach focuses on uncovering subtle abuse patterns that automated detections may miss

Key capabilities include:

• 24/7 threat monitoring through Microsoft Sentinel
• Managed Detection and Response (MDR) leveraging Defender XDR
• Continuous Threat Exposure Management (CTEM)
• Incident response and containment support
• Proactive threat hunting and identity security analysis

• ConsentFix debrief: Insights from the new OAuth phishing attack