New OAuth Phishing Technique

Security researchers have identified a new and more sophisticated iteration of an OAuth phishing technique targeting Microsoft Azure environments, now being referred to as ConsentFix v3. This latest variant has been spotted circulating across underground hacker forums, where it is being promoted as a significantly enhanced and automated version of earlier attack methods.

The origins of this attack family trace back to late last year, when Push Security introduced the concept of ConsentFix v1 — a method inspired by the well-known ClickFix approach but adapted specifically for OAuth-based phishing. That initial technique relied on social engineering to manipulate victims into completing a genuine Microsoft login process through the Azure CLI. Victims were deceived into manually pasting a localhost URL that contained an OAuth authorization code, which attackers could then leverage to acquire tokens and take over accounts, bypassing even multi-factor authentication protections.

A second version followed, developed by security researcher John Hammond, which streamlined the attack by removing the manual copy-paste step and replacing it with a drag-and-drop interaction involving the localhost URL. This change made the overall phishing experience feel more natural and harder for victims to recognize as malicious.

The third and latest version retains the foundational concept of exploiting the OAuth2 authorization code flow while continuing to target first-party Microsoft applications that carry pre-existing trust and consent within Azure environments. What sets v3 apart, however, is its emphasis on full automation and the capacity to operate at scale.

Based on details gathered from hacker forums promoting the technique, the attack follows a structured sequence. It begins with reconnaissance, specifically confirming whether Azure is present in the target organization by validating tenant IDs. Attackers then collect employee information — including names, job roles, and email addresses — to facilitate convincing impersonation.

To support the broader operation, attackers establish infrastructure across multiple platforms, including Outlook, Tutanota, Cloudflare, DocSend, Hunter.io, and Pipedream, each serving specific functions related to phishing delivery, content hosting, intelligence gathering, and data exfiltration.

Researchers at Push Security highlight that Pipedream, a serverless integration platform available at no cost, is central to what makes v3 distinctly more dangerous. The platform simultaneously acts as the webhook endpoint that captures the victim's authorization code, functions as the automation engine responsible for instantly exchanging that code for a refresh token through Microsoft's API, and serves as a real-time aggregator that makes the harvested tokens immediately accessible to the attacker.

Sophisticated Phishing Attack

In a new wave of cyberattacks, a phishing scheme takes shape utilizing Cloudflare Pages to create a deceptive interface resembling Microsoft’s Azure.

Attackers kick off the process by instigating a genuine OAuth flow through Microsoft’s login portal.

As victims engage with the counterfeit page, they find themselves redirected to a localhost URL that houses an OAuth authorization code.

Unwittingly, they copy or drag this information back into the phishing site, facilitating the extraction of credential data.

This action triggers a data exfiltration workflow, where the captured URL is sent to a Pipedream webhook, allowing backend automation to swiftly convert the authorization code into access tokens.

The phishing strategies employed are notably sophisticated, with emails tailored using harvested personal information. These messages often include harmful links concealed within a PDF hosted on DocSend, which enhances their credibility and helps evade spam detection systems.

Threats from ConsentFix v3

The automated OAuth exploitation tool ConsentFix v3

now poses a direct threat to Azure environments.

This latest iteration enables attackers

to automate the creation of malicious OAuth applications

and bypass user consent prompts,

facilitating unauthorized access.

Post-compromise, stolen tokens are funneled

into platforms like Specter,

granting adversaries persistent entry

to emails, files, and connected services

within the victim's Microsoft ecosystem.

Assessing the full scope of damage remains challenging,

as impact varies based on tenant configurations,

assigned permissions, and available services.

Mitigation is inherently complex,

given the architectural trust placed in first-party applications

and the utility of the shared token Family of Client IDs (FOCI).

Nevertheless, defensive measures are advised:

implementing token binding to trusted devices,

configuring behavioral detection rules,

and enforcing strict application authentication policies.

Although active campaigns utilize ConsentFix methods,

the adoption level of the v3 variant

within the broader criminal underground

is not yet fully determined.

A collection of four zero-day vulnerabilities has been combined into a single exploit, effectively circumventing the protections offered by both renderer and operating system sandboxes.

Anticipate an influx of new exploitation methods on the horizon.

Join us at the Autonomous Validation Summit, scheduled for May 12 and 14, to explore how autonomous, context-aware validation can identify exploitable areas, validate security measures, and ensure that remediation processes are effectively addressed.

Reserve your place now!

Why People Need VPN Services to Unblock Porn

People need VPN services to unblock porn primarily to bypass regional censorship and maintain privacy, as these tools mask their location and encrypt their connection. Porn unblocked refers to accessing adult content that is otherwise restricted by geographical or institutional filters, allowing users to view material freely and securely. This process enables individuals to circumvent local blocks and enjoy a private browsing experience without interference.

Why Choose SafeShell VPN to Access Adult Content

If you're looking to access region-restricted content and unblock porn sites, SafeShell VPN is an excellent solution to consider. This VPN service not only guarantees your anonymity while browsing but also provides users with the power to bypass geo-restrictions on various types of adult content. With a user-friendly interface and seamless performance, you'll find it easier than ever to explore a wide array of options without compromising your privacy.

One of the standout features of SafeShell VPN is its unparalleled speed. Unlike many other VPN services that can slow down your internet connection, SafeShell employs advanced technology that ensures fast and reliable access. This capability is particularly beneficial when streaming high-definition adult content, guaranteeing a smooth experience without interruptions or buffering issues. Additionally, the innovative App Mode feature allows users to access multiple regional services simultaneously, giving you an enhanced exploration experience.

Moreover, SafeShell VPN emphasizes top-notch security with its ShellGuard protocol, which keeps your browsing habits completely confidential. This powerful encryption protects you from surveillance and ensures that your personal data remains safe from prying eyes. With multi-device support for up to five devices, you can enjoy comprehensive protection across all your platforms, making SafeShell VPN a versatile tool for anyone seeking to unblock porn sites and enhance their online security.

How to Use SafeShell VPN to Unlock Porn Sites

To begin using SafeShell VPN for accessing region-restricted adult content, first, you must acquire the service by visiting the official SafeShell VPN website and selecting a suitable subscription plan. After completing the purchase, proceed to download and install the SafeShell VPN application on your device, ensuring it is correctly set up for initial use.

Once the application is installed, launch it and navigate to the settings to activate the specialized App Mode, which optimizes connectivity for such content. Then, from the server list, choose a location corresponding to the region whose content you wish to unlock. Finally, connect through SafeShell VPN to establish a secure, private tunnel, allowing you to browse freely and anonymously.