How Hackers Are Bypassing Passwords and MFA: Inside the ConsentFix Microsoft Account Heist

Imagine landing on a trusted website, only to have your Microsoft account silently hijacked-no password stolen, no multi-factor authentication tripped. This isn’t some hypothetical scenario, but the reality behind a devious new cyberattack: ConsentFix. Discovered by Push Security, this technique weaponizes the very tools Microsoft built for secure cloud access, turning Azure’s own command-line interface into a backdoor for criminals. Here’s how the attackers are gaming the system, and why your business email could be the key to your undoing.

The Anatomy of ConsentFix: From Phishing to Full Control

The ConsentFix scam begins like many phishing campaigns: with a carefully compromised website, ranked high on Google, luring in users searching for solutions or technical fixes. What sets it apart is its sophistication and restraint. Victims are presented with a phony Cloudflare CAPTCHA, requesting a business email address. Behind the scenes, the attackers filter out bots, analysts, and anyone not on their hit list, ensuring only prime targets move forward.

Next comes a page mimicking typical “ClickFix” interactions-think tech support scams that ask you to click through steps to prove you’re not a bot. Here, the user is instructed to “Sign in” via what appears to be a legitimate Microsoft login portal. But this isn’t a normal sign-in: it’s the Azure CLI OAuth flow, designed for developers and admins to manage cloud resources securely from their own machines.

If the user is already logged in, a single click suffices. Otherwise, they authenticate as usual-on the real Microsoft site. The twist? After authentication, Microsoft redirects them to a localhost URL containing a unique OAuth authorization code. The malicious page instructs the victim to copy and paste this URL back into the form-unknowingly handing the attacker the digital keys to their account. With that code, the hacker can generate a valid access token, bypassing both passwords and MFA protections entirely.

According to Push Security, the attack is designed to trigger only once per IP address, minimizing detection and making repeat investigations tricky. It’s a chilling demonstration of how attackers are evolving: rather than brute-forcing logins or phishing credentials, they’re exploiting trusted authentication flows and relying on user compliance-no malware required.

Conclusion: When Trust Is the Weakest Link

ConsentFix is a stark reminder that even the most robust authentication systems can be subverted when human trust is manipulated. As attackers turn tools meant for security into vectors for compromise, defenders must adapt-monitoring for anomalies, educating users, and questioning every “trusted” prompt. In the era of OAuth hijacks, your biggest vulnerability might just be the next click.

WIKICROOK: Glossary

OAuth 2.0

A widely used protocol that allows apps to access user data from web services without revealing the user’s password.

Azure CLI

Microsoft’s command-line tool for managing Azure cloud resources, including authentication via OAuth flows.

Multi-Factor Authentication (MFA)

A security process requiring more than one form of verification to access an account, such as a password and a code sent to your phone.

Phishing

A type of cyberattack where attackers trick individuals into revealing sensitive information by impersonating trusted entities.

Authorization Code

A temporary code issued during OAuth authentication, which can be exchanged for an access token to control user accounts or data.