New OAuth-Based Attack Lets Hackers Bypass Microsoft Entra Authentication to Steal Keys

A sophisticated attack dubbed “ConsentFix” (also known as AuthCodeFix) has emerged as a critical threat to Microsoft Entra ID environments, exploiting the legitimate OAuth 2.0 authorization code flow to steal authentication credentials and access tokens.

The attack, which evolved from the earlier ClickFix campaign, was initially detected by PushSecurity and has since been refined with improved delivery mechanisms that eliminate the need for manual user interaction.

How the Attack Works

ConsentFix targets the OAuth 2.0 authorization code flow used by native applications like Azure CLI and Azure PowerShell.

The attacker crafts a malicious Microsoft Entra login URI that points to the “Microsoft Azure CLI” client and the “Azure Resource Manager” resource.

When a victim visits the attacker’s website, it opens this URI, triggering a legitimate-looking authentication prompt.

The mechanism is deceptively simple: the application creates a listener on localhost using a random high port as the reply URI.

After successful authentication, the user is redirected to this localhost address. In normal circumstances, the Azure CLI would capture the authorization code from this redirect.

However, in the attack scenario, because no legitimate application is listening, the browser displays an error, but the sensitive authorization code remains visible in the URL.

The attacker then tricks the victim into sharing a URI containing the authorization code via drag-and-drop or copy-and-paste.

Once obtained, the attacker redeems the authorization code for bearer tokens, gaining access to Azure Resource Manager and other enterprise resources within the 10-minute validity window.

Detection Challenges and Signals

Analysis of Sign-in logs reveals two distinct events: an interactive sign-in from the victim and a subsequent non-interactive sign-in from the attacker’s infrastructure.

While these events can be correlated by shared SessionId, ApplicationId, and UserId, defenders face significant challenges in filtering legitimate activity from malicious patterns.

The authorization code UTI differs from the bearer token UTI, complicating traditional linking approaches.

The temporal window proves critical; the attacker must redeem the code within approximately 10 minutes.

This timing constraint, combined with IP address misalignment between the victim and attacker, provides valuable detection indicators.

However, benign false positives arise from cloud development environments such as GitHub Codespaces, which authenticate automatically within seconds.

Multiple Microsoft first-party applications with pre-consented permissions are vulnerable, including Microsoft Azure CLI, Azure PowerShell, Visual Studio, Visual Studio Code, and Teams PowerShell Cmdlets.

These applications possess high-privilege pre-consent across enterprise tenants and localhost redirect URIs, making them attractive targets for attackers seeking to establish persistent access.

Organizations can implement layered defenses across four primary approaches: limiting attack surface through user assignment requirements, deploying Conditional Access policies to block CLI tool access for non-privileged users, enforcing Token Protection with Web Account Manager on Windows devices, and implementing compliant network checks through Global Secure Access.

Token Protection provides the strongest mitigation for supported resources by requiring broker-managed proof-of-possession, effectively blocking browser-initiated authorization code flows.

ConsentFix represents a concerning evolution in OAuth-based attacks, demonstrating how attackers can weaponize legitimate authentication mechanisms.

Detection requires correlating multiple log signals and carefully tuning to distinguish legitimate activity from malicious behavior.

Organizations must prioritize implementing Token Protection and deploying enhanced monitoring of authorization code flows to detect and contain these sophisticated attacks before tokens can be redeemed for unauthorized access.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.