ConsentFix: AI-Powered OAuth Attack Steals Microsoft 365 Access Without MFA

ConsentFix bypasses Microsoft 365 MFA by targeting the OAuth authorization code issued after a legitimate, fully-authenticated session rather than attacking the login process itself. MFA verifies identity at sign-in. ConsentFix operates post-authentication, after MFA has already completed successfully, hijacking the tokens that verified session produces.

The attack exploits the Family of Client IDs (FOCI) feature in Microsoft Entra ID. FOCI allows trusted first-party Microsoft applications to share refresh tokens across the application family without requiring fresh authentication for each service. The abused applications include Azure CLI, Azure PowerShell, Microsoft Authentication Broker, Teams, Outlook, SharePoint, OneDrive, and Microsoft Graph PowerShell. Every standard enterprise Microsoft 365 tenant has these applications in a pre-consented state, meaning no administrator approval is required to use them as token relay points once an authorization code is captured.

When the victim drags the localhost callback URL as instructed by the fake completion prompt, the attacker's infrastructure receives the OAuth authorization code. A Pipedream serverless webhook exchanges it for access and refresh tokens within seconds. Microsoft Entra ID refresh tokens are long-lived. An attacker holding a valid refresh token maintains persistent access to email, Teams, OneDrive, SharePoint, and Microsoft Graph API for weeks after initial compromise until an administrator explicitly revokes the session.

Standard Conditional Access policies requiring compliant devices are insufficient on their own. ConsentFix uses the victim's own corporate device during the authentication step, which satisfies device compliance checks before the token capture occurs. The attacker's subsequent use of the stolen token from a different IP address is the primary behavioral signal available for detection. Microsoft Entra ID Token Protection policies, currently in public preview, bind access tokens to the originating device session and represent the most effective technical control available against captured token reuse.

The AI component of ConsentFix v3 makes mass deployment operationally viable for criminal groups that previously lacked the technical capacity to run targeted identity phishing campaigns. ConsentFix v3 includes modules for AI-driven persona creation generating convincing sender identities from social media data, automated spear-phishing email drafting tailored to the victim's LinkedIn role and employer, and campaign management infrastructure that tracks delivery rates, click rates, and successful token captures without manual operator involvement.

Dark LLMs power the content generation layer. These are self-hosted AI models exceeding 80 billion parameters, available through criminal subscription services priced between $30 and $200 per month, with an estimated 1,000 or more active criminal subscribers in 2026 according to Group-IB research. Dark LLMs operate without content filters or abuse reporting mechanisms. A subscriber generates unlimited phishing lures, persona backstories, and pretextual email threads at a quality level that removes the grammar errors and awkward phrasing that security-aware employees previously used to identify phishing.

Cloudflare Workers and Pipedream serverless platforms route token capture and exchange operations through legitimate cloud infrastructure. ConsentFix operators do not run dedicated criminal servers that appear in threat intelligence feeds. The attack infrastructure blends with normal Microsoft cloud API traffic, making network-layer detection substantially harder than for campaigns that host malicious content on attacker-controlled domains.

AI-generated X ads funnel additional victims into the attack chain. The July 3, 2026 campaign used sponsored posts from a verified X account to impersonate a legitimate macOS application, redirecting clicks to a lookalike domain at dynamicmacisland[.]com. Mac users received Atomic Stealer via ClickFix terminal command injection. Windows enterprise users were redirected to a ConsentFix token theft flow. Both attack branches executed through a single AI-generated advertising campaign that cost the attacker no more than a standard social media ad buy.

APT29 is a Russian Foreign Intelligence Service (SVR) hacking unit also designated Cozy Bear and Midnight Blizzard. APT29 is responsible for the 2020 SolarWinds supply chain attack, the 2023 Microsoft corporate email breach, and persistent credential-theft campaigns against NATO governments and diplomatic institutions. The group weaponized the ConsentFix technique for initial access in targeted campaigns against government and enterprise Microsoft tenants in late 2025, reflecting its ongoing shift from vulnerability exploitation toward identity-based attacks that produce durable access with a lower detection footprint.

ConsentFix became accessible to criminal operators through its March 2026 publication on a prominent Russian cybercrime forum. The guide included working code, Pipedream and Cloudflare Workers configuration instructions, LinkedIn-based target profiling methodology, and a video tutorial demonstrating the complete attack chain from phishing email delivery to successful token capture and session access. This publication reduced the technical barrier from APT29-level development resources to any criminal group willing to read a forum post and purchase a dark LLM subscription.

The July 3, 2026 campaign documented by Malwarebytes demonstrates the speed at which APT29 techniques become criminal tools. What APT29 weaponized for government espionage in late 2025 was available as a deployable attack kit by March 2026 and was running in paid social media advertising campaigns by July. The agentjacking attack against Sentry MCP followed the same pattern: sophisticated AI-driven attack techniques developed by advanced actors become commoditized criminal tools within one to two quarters of initial deployment.

The AI-weaponized attack ecosystem delivering ConsentFix is producing documented financial damage at scale. The Arup CFO deepfake incident established the single-interaction damage ceiling: live AI-generated video convincing employees on a Zoom call they were speaking with legitimate company executives resulted in a $25 million wire transfer authorization. Resemble.ai's 2026 fraud intelligence report documents $350 million in deepfake-enabled fraud losses in Q2 2025 alone, concentrated in finance, insurance, and technology sectors.

Cloudflare's 2026 threat report documents attackers using AI to identify high-value data locations within target environments, enabling compromise of hundreds of corporate tenants through a single supply chain attack vector. AI reconnaissance reduced the analysis time required to identify exfiltration targets from days to hours, accelerating post-compromise data staging significantly. Cloudflare researchers also confirmed North Korea specifically exploits deepfake-based infiltration, placing AI-generated fake personas within organizations as remote employees to access administrative and financial systems.

The Sophos AI ransomware lab research documented AI generating EDR evasion payloads that bypassed endpoint protection on managed devices. ConsentFix applies AI-driven content generation to the social engineering layer rather than the malware layer, which means endpoint defenses trained to detect malicious executables provide zero protection against a successful ConsentFix token capture. An organization can have fully patched endpoints, deployed EDR, enforced MFA, and enabled DLP and still lose Microsoft 365 access to ConsentFix because the attack operates entirely within legitimate authentication flows.

ConsentFix produces specific behavioral signals in Microsoft Entra ID sign-in logs and Microsoft 365 unified audit logs. Security teams with Entra ID Premium P2 or Microsoft Sentinel can build detection rules targeting the OAuth patterns ConsentFix generates.

The primary detection signature targets OAuth2:Authorize requests with Redirect status against the deprecated Windows Azure Active Directory resource identifier 00000002-0000-0000-c000-000000000000, combined with subsequent FOCI application activity accessing Microsoft Graph from IP addresses outside the victim's established geolocation. This combination identifies authorization code capture followed by attacker-side token exchange in a different geographic location.

Secondary detection signals include OAuth authorization code exchanges from IP addresses not associated with the victim's active browser session; access and refresh token usage from geolocations inconsistent with the user's normal working pattern; Pipedream or Cloudflare Workers serverless domains appearing in OAuth redirect URI fields; and bulk mailbox access or OneDrive enumeration via Microsoft Graph API calls immediately following a new OAuth consent grant.

In Microsoft 365 Defender, enable the Identity Threat Protection risky sign-in policy and configure alerts for impossible-travel events combined with new OAuth app grant activity. Review Entra ID non-interactive sign-in logs, which capture token refresh activity not visible in the interactive sign-in report, specifically for token reuse from unexpected source IP addresses.

Conduct a one-time OAuth consent grant audit using the Microsoft 365 activity explorer filtered to the OAuthConsent event type. Revoke any consent grant your team did not explicitly authorize. Block the ClickFix delivery domain dynamicmacisland[.]com at DNS and web proxy layers. Repeat the consent audit monthly while ConsentFix campaigns remain active.

Closing the ConsentFix Microsoft 365 MFA bypass requires simultaneous changes to Entra ID OAuth settings, Conditional Access configuration, and user awareness training. No single control is complete on its own.

Disabling user OAuth consent removes the mechanism ConsentFix exploits to issue tokens without administrator knowledge. Navigate to Entra ID > Enterprise Applications > Consent and Permissions > User Consent Settings and set the policy to "Do not allow user consent." This requires administrator approval for any OAuth application token grant before tokens can be issued, including ConsentFix delivery infrastructure.

Service Principal restrictions on FOCI-eligible first-party apps reduce the token sharing surface. Configure Conditional Access policies for Azure CLI, Azure PowerShell, Microsoft Authentication Broker, and Microsoft Graph PowerShell requiring device compliance, sign-in risk score thresholds, and named location verification. These policies do not stop token capture but flag the attacker's subsequent token reuse from an unfamiliar location.

Microsoft Entra ID Token Protection in public preview binds access tokens to the originating device session. An attacker who captures a token from a different device or IP address finds the token operationally useless in an environment with Token Protection enforced.

User training must specifically address the localhost callback URL drag mechanic. Standard phishing awareness that focuses on suspicious email links does not address ConsentFix delivery. Employees who understand that no legitimate Microsoft service will ever ask them to drag a URL from a web page into the browser address bar will break the ConsentFix attack chain at the social engineering step before any token is captured.

Microsoft 365 is the productivity platform for an estimated 400 million commercial users worldwide. ConsentFix targets every one of them. The technique requires no vulnerability in Microsoft's code, no specific misconfiguration, and no compromised endpoint. Any enterprise user who authenticates to Microsoft 365 in a browser and encounters a ConsentFix delivery page faces the same risk regardless of device management status, patch level, or MFA enrollment.

The security assumption that MFA stops credential phishing is invalid for OAuth-based attacks. ConsentFix exploits that assumption at scale. Security teams that deployed MFA as their primary defense against Microsoft 365 account takeover have an open gap. A ConsentFix compromise generates no failed authentication events, no MFA rejection logs, and no password change indicators that standard security monitoring would alert on. The signals are in OAuth audit logs that most organizations do not actively monitor.

The industrialization pathway from APT29 nation-state technique in late 2025 to criminal subscription toolkit available on cybercrime forums by March 2026, and deployed via AI-generated paid social media advertising by July 2026, reflects what AI does to the threat landscape. Technical sophistication requiring government-level resources becomes a dark LLM prompt and a $200 monthly subscription. Organizations that benchmark their defenses against the 2024 threat model have a structural gap against AI-weaponized identity attacks deployed in 2026.

The three controls that close the ConsentFix gap cost nothing beyond configuration and training time: disable user OAuth consent, enable token protection, and add the drag-mechanic to security awareness programs. Leaving them unaddressed means MFA provides false confidence against an attack that does not need to defeat MFA at all.