The “Fix” is a Trap: ConsentFix Phishing Bypasses MFA via Azure CLI

ConsentFix (AuthCodeFix) is a phishing technique that abuses the OAuth2 authorization-code flow for legitimate Microsoft first-party apps by redirecting victims to a localhost URL and instructing them to paste the URL (which contains the authorization code) into a phishing site; attackers then exchange that code for access tokens to bypass MFA and Conditional Access. The attack is difficult to block without impacting developer tools, but defenders can hunt for it by correlating the victim’s initial sign-in with a subsequent token exchange showing the same session ID from disparate IPs/locations in AADNonInteractiveUserSignInLogs.