New ConsentFix Attack Let Attackers Hijack Microsoft Accounts by Leveraging Azure CLI

Cybersecuritynews •Abinaya • December 12, 2025

A sophisticated new phishing attack technique called “ConsentFix” that combines OAuth consent phishing with ClickFix-style prompts to compromise Microsoft accounts without requiring passwords or multi-factor authentication. The attack leverages the Azure CLI app to gain unauthorized access to victim accounts. The ConsentFix attack operates entirely within the browser context, making it difficult for traditional security […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ConsentFix Attack Exploits Azure CLI to Compromise Microsoft Accounts The ConsentFix attack is a new phishing technique that allows attackers to hijack Microsoft accounts by exploiting the Azure CLI app. This method bypasses traditional security measures such as passwords and multi-factor authentication, operating entirely within the browser context. Victims of this attack are primarily Microsoft account users. 2 sources 20

Extracted Entities

New ConsentFix Attack Let Attackers Hijack Microsoft Accounts by Leveraging Azure CLI

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Tools (1)