New ConsentFix attack hijacks Microsoft accounts via Azure CLI

A newly observed phishing campaign dubbed "ConsentFix" abuses the Azure CLI OAuth flow to hijack Microsoft accounts without passwords or MFA. Attackers lure targets to compromised sites that present a fake CAPTCHA and ClickFix-style instructions, prompt the user to complete an Azure CLI OAuth sign-in which redirects with an authorization code, and then instruct victims to paste the redirect URL back into the malicious page so the attacker can exchange the code for access. Push Security and reporting outlets recommend monitoring for unusual Azure CLI login activity and legacy Graph scopes to detect abuse.