What Is ConsentFix? The OAuth Attack Bypassing Passwords and MFA

A user is asked to verify they are human. They copy a short piece of text, paste it into an official-looking Microsoft page, and continue with their day. Nothing about a password was ever asked. No MFA prompt reappeared. And yet, by pasting that text, they just handed an attacker a valid, authenticated connection to their Microsoft account. That is ConsentFix, a technique that borrows the paste-and-run trick from ClickFix and points it at something far more persistent than malware: a legitimate OAuth authorization token.

This guide explains what ConsentFix is, how the attack actually works, how it differs from device code phishing, a related but distinct technique, and what organizations can do about it.

How ConsentFix Actually Works

ConsentFix was first publicly documented by Push Security in December 2025, who named it for its resemblance to the ClickFix technique, and initially observed it being used in a campaign attributed to a Russian state-affiliated group.

The attack specifically abuses the Azure CLI’s OAuth application, following this general pattern:

1. The victim is presented with a page requiring “verification,” styled similarly to a ClickFix-style fake CAPTCHA or human-check prompt.
2. The victim is guided through initiating an Azure CLI login, which generates a genuine OAuth authorization code visible in a localhost callback URL on their own machine.
3. The victim is instructed to copy that localhost URL and paste it into the attacker-controlled page, believing this completes their own verification.
4. The attacker uses the pasted authorization code to complete the OAuth handshake from their own device, establishing a valid connection between the victim’s Microsoft account and the attacker’s Azure CLI instance.

At no point does the victim enter a password. At no point does a fake login form appear. The entire exchange happens through Microsoft’s genuine authentication infrastructure, with the victim unknowingly handing over the one piece of information, the authorization code, that lets the attacker complete the process from elsewhere.

How ConsentFix Differs From Device Code Phishing

ConsentFix and device code phishing are often mentioned together because both abuse OAuth to gain account access without stealing a password, but they exploit different parts of the OAuth framework and work differently in practice.

The practical distinction matters for detection and training: device code phishing centers on entering a code on a legitimate Microsoft page, while ConsentFix centers on copying and pasting a URL between windows, the same core mechanic used in ClickFix and its variant FileFix. Employees trained to recognize one pattern will not automatically recognize the other unless both are covered explicitly.

Why ConsentFix Is Hard to Detect

A few specific factors make ConsentFix difficult for traditional security tools and typical user awareness to catch. According to Arctic Wolf’s analysis of the technique, the attack was first linked to a state-sponsored threat actor, underscoring both its sophistication and its likely spread to less advanced attackers over time, a pattern already seen with ClickFix and device code phishing.

What This Means for Organizations

ConsentFix reinforces a pattern across an entire family of attacks, including ClickFix and device code phishing, that succeed by convincing a user to complete a legitimate-looking action themselves, rather than by exploiting a technical vulnerability directly. A few practical implications follow:

Testing Awareness Against This Pattern

Because ConsentFix relies on the same paste-and-comply instinct as ClickFix and FileFix, rather than a fake login page, testing for it benefits from the same behavioral, simulation-based approach already used for related techniques. Running a realistic verification-style scenario through a phishing test for employees shows whether your team pauses before pasting an unfamiliar code or URL into any system prompt, regardless of which specific technique is behind it. Tracking this alongside other paste-and-run techniques feeds into a more complete employee phishing risk score.

Final Thoughts

ConsentFix is a reminder that the paste-and-comply trick behind ClickFix was never limited to installing malware. The same instinct, trusting a legitimate-looking page enough to paste something into it without questioning why, can just as easily hand over a valid, persistent connection to a cloud account. As attackers continue finding new legitimate processes to redirect for this purpose, the underlying defense stays the same: treat any unsolicited instruction to copy and paste something into a system prompt as a reason to stop and verify first, no matter how official the surrounding page looks.

FAQ