Reported by 1 outlet

Timeline

1. original reporting

   ConsentFix v3 introduces fully automated Azure OAuth abuse — Pipedream webhooks eliminate manual token theft

   bleepingcomputer.com · 164d ago · May 3rd, 2026

   A new variant of the ConsentFix OAuth phishing technique, circulating on hacker forums, automates what was previously a manual social engineering attack into a scalable pipeline targeting Microsoft Azure tenants. The v3 attack chain begins by validating target tenant IDs, then harvesting employee details to craft personalized phishing lures hosted on Cloudflare Pages. The critical innovation is the use of Pipedream (a free serverless integration platform) as a three-in-one automation layer: webhook endpoint to receive the victim's OAuth authorization code, immediate token exchange engine via Microsoft's API, and real-time token collector. Phishing emails embed malicious links inside PDFs hosted on DocSend to bypass spam filters. Captured tokens are then imported into Specter Portal for interactive access to the victim's Microsoft environment — email, files, and any services the token permits. The attack exploits the architectural trust placed in first-party Microsoft apps through the Family of Client IDs (FOCI) mechanism, which shares permissions across Microsoft applications. Push Security researchers confirmed the technique works but note that real-world impact depends on tenant configuration and permissions. Mitigations include token binding to trusted devices, behavioral detection rules, and app-level authentication restrictions. Organizations relying on Microsoft SaaS should audit OAuth consent grants, particularly for first-party apps, and implement conditional access policies that can revoke tokens when risk signals change.