ConsentFix v3 attacks target Azure with automated OAuth abuse

ConsentFix v3 is a new OAuth2 abuse technique that automates the capture of Azure authorization codes and token exchange using a serverless workflow. The method verifies the target tenant ID, harvests employee details, and creates accounts on services such as Outlook, Tutanota, Cloudflare, DocSend, Hunter.io, and Pipedream. A phishing page hosted on Cloudflare Pages mimics the Microsoft/Azure login interface and tricks victims into pasting a localhost URL containing the authorization code. Pipedream receives the code via a webhook, immediately exchanges it for a refresh token through Microsoft’s API, and stores the token in real time. The attacker then imports the tokens into Specter Portal to access resources such as email, files, and other services. The attack relies on first‑party Microsoft apps that are pre‑trusted and pre‑consented, and it can scale by automating the entire flow. Mitigation steps include applying token binding, setting behavioral detection rules, and enforcing app authentication restrictions. While the technique is still emerging, administrators should review OAuth client configurations and enforce stricter access controls.

The attack flow demonstrates how social engineering, phishing, and serverless automation can combine to bypass MFA and obtain long‑lived tokens without passwords. It highlights the need for Azure AD Conditional Access policies that block unknown OAuth clients and require PKCE for all authorization code requests. The use of Pipedream as an automation engine shows that attackers can leverage free services to run the entire pipeline.

Overall, ConsentFix v3 shows that OAuth authorization code flows remain a high‑risk vector when client secrets are not enforced and when users can be tricked into pasting local URLs. Administrators should audit their OAuth client registrations, enforce token binding, and monitor for unusual token exchange patterns.