Known malicious kitcriticalphishing

ConsentFix — OAuth authorization-code phishing via Azure CLI and other first-party Microsoft apps

family: consentfix-oauth-code-2026-09

ConsentFix is a ClickFix-style account takeover with no credential form. The lure page (often behind a fake Cloudflare Turnstile or 'verify you are human' step) sends the victim to the genuine Microsoft sign-in page for a pre-consented first-party public application, most often Microsoft Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46) or Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2), with a redirect_uri of http://localhost. A victim who is already signed in is bounced straight to a localhost URL carrying an OAuth authorization code, and the page asks them to copy that URL back into it (v1) or drag it across from a pop-up window (v2). Public clients have no secret, so the code alone is exchanged for access and refresh tokens on the attacker's machine, bypassing most Conditional Access policies. The same technique has been linked to APT29 and has since been packaged into a criminal toolkit (v3). This hunt matches the lure page itself: Microsoft authorize URL + loopback or nativeclient redirect + a first-party public client id + code that reads the resulting URL back from the victim (paste or drop handler, or code= extraction).

Anchors

YARA ruleConsentFix_OAuth_AuthCode_Lure

Provenance

Added: 2026-09-25 12:18

Structural match on the page or its scripts, independent of lure domain, brand or hosting. A web page has no legitimate reason to start an Azure CLI or Azure PowerShell sign-in that returns to localhost, and none to read that URL back from its visitor. Write-ups and documentation that merely quote the attack URL do not match, because they carry no capture step. Not covered: kits that fetch the sign-in URL from their backend only after an email or Turnstile gate, so the URL never appears in the captured page. For defenders (per the glueckkanja analysis): the attack typically targets Azure Resource Manager with a redirect to a high localhost port such as http://localhost:3001. In Entra sign-in logs, look for an interactive sign-in followed by a non-interactive sign-in for one of these application ids, with the same SessionId and user, from a different IP address, within roughly ten minutes (authorization codes expire after about ten minutes). Exclude pairs only seconds apart, which are benign automated redemptions such as GitHub Codespaces; the manual copy or drag step leaves a visible delay. Mitigations, from least to most effort: require user assignment (AppRoleAssignmentRequired) on service principals for these first-party apps, block them with Conditional Access for users who do not need them, enforce compliant-network checks, and Token Protection, under which a browser-obtained code cannot be redeemed because the browser cannot supply the broker-signed proof of possession.

References:

Sightings (0)

No sightings recorded yet.