ConsentFix — page observed starting an Azure CLI / first-party sign-in that returns its code to localhost

Behavioural anchor for ConsentFix-style OAuth authorization-code phishing. Matches a scan in which the page itself sent the browser to the Microsoft identity platform's authorize endpoint for a pre-consented first-party public client (Azure CLI, Azure PowerShell, Visual Studio / VS Code, Teams or SharePoint PowerShell, Microsoft Office, the Authentication Broker) with a redirect_uri of http://localhost or the native-client page. That is how the lure obtains a code for the victim's account: a web page has no reason to start a desktop tool's sign-in, and the only use of the resulting localhost URL is to have the visitor hand it back. Includes pages where the sign-in only opens after clicking the page's own 'Sign in' / 'Verify' button, including the pop-up (drag-and-drop) variant.