Azure CLI Trust Abused in ConsentFix Account Takeovers

Azure CLI Trust Abused in ConsentFix Account Takeovers

Security researchers are warning about a new phishing technique that allows attackers to take over Microsoft accounts without stealing passwords or bypassing multi-factor authentication directly.  The attack, known as ConsentFix, exploits implicit trust in Microsoft’s Azure Command-Line Interface (CLI) and relies on subtle user interaction rather than malicious login pages. This is a “… browser-native ClickFix attack that phishes an OAuth token …

New Attack Technique “ConsentFix” Hijacks OAuth Consent Grants

On December 11, 2025, Push Security published research detailing a newly observed browser-based phishing technique called ConsentFix. The name ConsentFix is derived from its similarity to the previously documented ClickFix technique using fake CAPTCHA pages.  ConsentFix, enables threat actors to gain cloud account access without capturing passwords, multifactor authentication (MFA) codes, or other credentials by abusing legitimate OAuth authenti…