What is a ConsentFix attack?

ConsentFix is a browser-native phishing attack that tricks you into copy-pasting a localhost URL containing an OAuth authorization code into a phishing page. This gives the attacker an access token to your Microsoft account — without your password and without triggering MFA.

How does ConsentFix bypass MFA?

ConsentFix abuses the OAuth authorization code flow used by apps like Azure CLI. The attacker tricks you into generating an authorization code by logging in to a legitimate app, then pasting the URL containing that code into the attacker's page. The code is then redeemed for an access token — no password or MFA prompt required.

How can I tell if an email or link is a phishing scam?

Paste the suspicious email, link, text message or QR code into PhishGlass. Its AI returns a 0-100 phishing risk score within seconds, highlights the exact red flags in plain English, and tells you the safest next step — so you know whether it's safe before you click, reply or pay.

Who is PhishGlass for?

PhishGlass is built for freelancers, small business owners, and finance, legal and real estate professionals who handle money and sensitive requests, as well as executives and security-conscious individuals who can't afford to fall for a scam. It needs no IT department or technical knowledge.

How much does PhishGlass cost?

You get 3 free scans per day with no account required. For more, start a 7-day Pro trial at $9.99/month (500 scans, PDF reports, scan history) — no credit card required. Or pay as you go from $1 per scan, with bundles of 5 to 50 scans available from $0.60/scan.

Does PhishGlass store my emails or messages?

No. PhishGlass is privacy-first and GDPR compliant. Your message content is analyzed securely and never stored — scan history keeps only metadata such as the risk level and date, never the original text.

Can PhishGlass detect business email compromise and fake invoices?

Yes. PhishGlass is designed to flag business email compromise, fake invoices, vendor-impersonation and account-takeover lures, as well as modern attacks like QR code scams and ClickFix-style social engineering that ordinary spam filters miss.

Attack Guide

ConsentFix Attacks: How OAuth Token Theft Bypasses MFA

Answer: ConsentFix is a browser-native phishing attack that tricks you into copy-pasting a URL containing an OAuth authorization code into an attacker-controlled page. The attacker redeems that code for an access token to your Microsoft account — without your password and without triggering MFA. It effectively bypasses passkeys and other phishing-resistant authentication.

How does a ConsentFix attack work?

You visit a compromised or malicious website, often through SEO-poisoned search results or malicious ads.
The page displays a fake Cloudflare Turnstile or CAPTCHA and asks for your email address to proceed.
If your email domain is on the attacker\'s target list, the page loads the next stage — a fake verification prompt.
The page instructs you to complete "verification" steps that involve logging in to Azure CLI or a similar app.
After logging in, your browser navigates to a localhost URL containing an OAuth authorization code in the address bar.
The page instructs you to copy that URL and paste it into a form on the phishing page.
The attacker captures the authorization code and redeems it for an access token — gaining programmatic access to your Microsoft 365, Azure, and Entra ID resources.

Sources: Push Security (December 2025), Mitiga Security, Microsoft Learn OAuth documentation.

What are the warning signs of ConsentFix?

A webpage instructing you to copy a URL from your browser's address bar and paste it into a form
A fake Cloudflare Turnstile or CAPTCHA that requires an email address to proceed
Instructions to run Azure CLI or a terminal command as part of "verification"
A page that only activates if you provide a specific corporate email domain (conditional loading)
A fake verification page that asks you to "complete additional steps" after entering an email

What should you do if you encounter a ConsentFix page?

Do not copy or paste any URL from your browser's address bar into a webpage form.
Close the page immediately if it instructs you to run Azure CLI or paste a localhost URL.
If you already pasted the URL, sign out of all Microsoft sessions and revoke OAuth app permissions.
Check your Microsoft Entra ID sign-in logs for unexpected Azure CLI login events.
Report the incident to your IT or security team immediately.
Scan the suspicious URL or page screenshot with PhishGlass to confirm the risk level.

How does PhishGlass detect ConsentFix?

PhishGlass is specifically trained to recognize ConsentFix attack patterns. When you scan a suspicious URL or screenshot, PhishGlass checks for:

Instructions to copy-paste a localhost URL or browser address bar content
Fake Cloudflare Turnstile or CAPTCHA used as a pretext for OAuth code theft
Conditional loading that only activates for specific email domains
Azure CLI or terminal command instructions disguised as verification steps
Social-engineering cues designed to extract OAuth authorization codes

Scan a suspicious link with PhishGlass Read the full safety guide