ConsentFix is a browser-native OAuth consent phishing technique uncovered by Push Security in late 2025. Initially attributed to Russian actors, it has since appeared in criminal toolkits. Like device code phishing, it targets the authorization layer and defeats passkeys.