What is ConsentFix? The ConsentFix campaign is a zero-malware hijacking attack that bypasses traditional security and multi-factor authentication by exploiting OAuth application consent flows in Microsoft 365, granting attackers persistent, API-level access to sensitive corporate data.

Executive Summary

Cybercriminals have increasingly turned to evasive, zero-malware techniques to infiltrate corporate cloud networks. Security researchers have warned of a highly active campaign dubbed "ConsentFix." This sophisticated attack entirely bypasses traditional endpoint antivirus scanners and multi-factor authentication (MFA) mechanisms by cleverly exploiting OAuth application consent flows inside Microsoft 365 infrastructure.

By tricking corporate users into voluntarily granting permissions to a rogue enterprise application, attackers effortlessly obtain persistent, programmatic API access to the victim's mailbox, cloud storage, and directory services. Administrators must aggressively lock down application consent policies immediately to mitigate this highly stealthy threat and protect organizational data integrity.

Deep-Dive Technical Analysis

Unlike traditional phishing campaigns that harvest user passwords or deploy malicious executables on host machines, ConsentFix relies entirely on OAuth 2.0 authorization flows—the standard framework that allows cloud applications to seamlessly share resources with other applications and services.

The Attack Mechanics

The attack mechanics utilize the following malicious sequence to establish a foothold:

1. The Deceptive Consent Lure: The attacker initiates the compromise by sending a highly targeted spear-phishing email, sponsored link, or chat message containing a URL. This link reliably redirects the user to a legitimate Microsoft 365 sign-in and authorization screen, adding a false sense of security.
2. The Rogue Enterprise App: The authorization screen formally requests the user to grant access permissions to an "enterprise application" newly registered on the Azure tenant. The malicious app is typically given a highly plausible and benign name (e.g., "M365 PDF Utility", "Office Update Helper", or "HR Document Viewer").
3. Programmatic Token Issuance: The rogue application requests incredibly sensitive, high-privilege permissions, such as Mail.ReadWrite, Files.ReadWrite.All, and offline_access. Once the unsuspecting victim clicks "Accept," the Microsoft authorization server generates an OAuth access token and a highly valuable refresh token for the attacker's application.
4. Persistent, Password-Less Hijack: Armed with the newly minted refresh token, the attacker can programmatically query the Microsoft Graph API. This allows them to read and write emails, exfiltrate confidential files from OneDrive and SharePoint, or continuously monitor user activity. This access remains active indefinitely, completely bypassing password resets and interactive MFA prompts, and most alarmingly, does not require any malware to run on the victim's local device.

Because the initial compromise and subsequent data exfiltration occur entirely within Microsoft's legitimate cloud infrastructure, traditional endpoint security utilities, standard antivirus tools, and local network firewalls remain completely blind to the intrusion.

Industry Impact and Recommendations

The devastating ConsentFix campaign represents a major, calculated shift in modern cybercriminal tradecraft. It highlights exactly how easily hardened cloud perimeters can be bypassed when end-users remain over-privileged. A compromised Microsoft 365 tenant can seamlessly lead to massive corporate data theft, sophisticated business email compromise (BEC) attacks, and completely unauthorized financial wire transfers that cost organizations millions.

Security Controls and Mitigation Strategies

We strongly recommend that all corporate cloud administrators implement the following immediate security controls to defend their environments:

• Enforce Restricted User Consent Policies: Immediately modify Microsoft Entra ID (formerly Azure AD) core settings to block standard users from autonomously consenting to third-party applications, particularly those requesting high-privilege read or write permissions. All external application requests should require explicit, reviewed administrator approval.
• Audit Active Enterprise Applications: Regularly and thoroughly audit the "Enterprise Applications" directory inside your Microsoft Entra ID administrative portal. Scrutinize all registered apps for suspicious naming conventions, unknown developer profiles, or excessive permission scopes (especially targeting offline_access and Mail.ReadWrite).
• Configure Alert Rules for Consent Grants: Establish proactive, automatic security alerts in your SIEM (Security Information and Event Management) platform or Microsoft Defender for Cloud Apps. These systems should flag immediately whenever any user grants consent to a newly registered or fully external application.
• Implement Continuous Session Revocation: In the exact event of a suspected or confirmed account compromise, administrators should immediately revoke all active refresh tokens and OAuth permissions associated with the compromised user account. This can be rapidly achieved via the Azure portal or administrative PowerShell scripts.

Frequently Asked Questions (FAQ)

References

• Malwarebytes Security Blog
• Cyber Recaps