ConsentFix OAuth Token Theft via Browser Storage Access or Script OAuth Redirect

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.