ConsentFix v3 Automates OAuth Abuse to Bypass MFA and Hijack Azure Accounts

ConsentFix v3 automates an OAuth authorization-code phishing technique against Azure/Microsoft 365: attackers verify Azure tenant presence, harvest employee data for personalized phishing, host convincing pages via Cloudflare/DocSend, and use Pipedream as a webhook to exchange captured authorization codes for refresh tokens—thereby hijacking accounts despite MFA. The report highlights scale and stealth because the flow uses legitimate Microsoft apps and first-party consents, and recommends mitigations including token binding, anomalous OAuth detection and user training.