Loading story…
Microsoft warned that consent phishing campaigns are increasingly abusing the OAuth authorization flow in Microsoft 365 to trick users into granting attacker-controlled applications access to corporate cloud data. In campaigns observed against remote workers, attackers sent phishing emails through compromised domains or cloud providers, then redirected victims to malicious Office 365 OAuth apps disguised as legitimate services. One campaign impersonated Mexico’s tax administration service to target Spanish-speaking users, while another used financial-themed lures aimed at investment teams; Microsoft later described similar tactics using a "Review Doc(s) & Sign" lure tied to a fake business services brand.
If a user approved the requested permissions, the attackers could obtain access and refresh tokens and use them to access email, files, contacts, SharePoint resources, OneDrive for Business data, and mailbox forwarding settings without directly stealing passwords. Microsoft said it had taken down malicious infrastructure and disabled rogue OAuth apps, while urging organizations to tighten Microsoft identity platform consent settings, limit user consent to verified publishers and low-risk permissions, audit application grants, and use Microsoft Defender for Office 365 and related tooling to detect and remediate illicit consent grants.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
In late January, Microsoft shared a private security advisory with Microsoft Defender ATP subscribers warning of increasing consent phishing activity targeting remote workers.
Microsoft said Office 365 protections against consent phishing, including app consent policies and publisher verification, became generally available starting in October 2020.
A second OAuth phishing campaign used financial lures aimed at organizations' investment teams. Microsoft said the campaign spiked multiple times between October and December 2020.
A consent phishing campaign impersonating Mexico's tax administration service targeted Spanish-speaking victims on two occasions. Microsoft said this activity occurred in September and October 2020.
Microsoft had previously warned that phishers were moving to consent phishing tactics that abuse OAuth app permissions instead of stealing credentials directly.
Microsoft observed a recent consent phishing campaign impersonating a business growth solutions company and using a 'Review Doc(s) & Sign' lure that linked to a malicious OAuth URL.
Microsoft threat analysts said telemetry showed a continued increase in consent phishing emails abusing OAuth request links in recent months.
Microsoft said it took legal action to dismantle part of the attack infrastructure by taking down six domains hosting malicious Office 365 OAuth apps and also identified and disabled malicious OAuth applications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
docs.microsoft.com
Open sourcedocs.microsoft.com
Open sourcemicrosoft.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026
A new phishing technique called **ConsentFix** has emerged, targeting Microsoft account users by exploiting the Azure CLI OAuth authentication flow. Discovered by Push Security, this attack is a sophisticated evolution of the earlier ClickFix scam, leveraging social engineering to trick victims into providing OAuth 2.0 authorization codes. Attackers compromise legitimate websites that rank highly in Google search results, presenting visitors with a fake Cloudflare CAPTCHA widget that requests a business email address. If the email matches a target list, the victim is guided through a process that mimics legitimate Microsoft login procedures, ultimately leading them to open a real Microsoft URL and copy a URL containing an OAuth token. Unlike previous ClickFix attacks that required users to execute malicious commands on their devices, ConsentFix operates entirely within the browser, making it harder for traditional endpoint security tools to detect. By capturing the OAuth token, attackers gain full access to the victim's Microsoft account via the Azure CLI, bypassing both passwords and multi-factor authentication (MFA). This method circumvents email-based anti-phishing controls and highlights the growing sophistication of consent phishing attacks targeting cloud authentication mechanisms.
Jul 3, 2026
Researchers reported a new phishing technique, **ConsentFix v3**, that targets Microsoft Azure accounts by abusing the OAuth2 authorization code flow and trusted first-party Microsoft applications. The attack sends victims through a legitimate Microsoft sign-in process, then tricks them into pasting or dragging a localhost redirect URL containing an authorization code back into a phishing page. Attackers can then exchange that code for tokens, enabling access to Microsoft resources such as email and files without needing the victim’s password and even when MFA is enabled. The latest variant expands on earlier ConsentFix methods by adding automation and scale through third-party services including **Cloudflare Pages** for phishing infrastructure and **Pipedream** for capturing authorization codes, exchanging them for refresh tokens, and collecting stolen tokens; reports also noted use of platforms such as **DocSend**. The technique also incorporates tenant enumeration and employee impersonation to improve targeting. Defenders were advised that mitigation is challenging because trust in Microsoft first-party apps is built into the architecture, but measures such as token binding, behavioral detections, and restricting app authentication can reduce exposure. Researchers said ConsentFix-style attacks have appeared in real campaigns, although widespread adoption of the v3 variant has not yet been confirmed.
Jun 29, 2026