Microsoft has recently issued a warning regarding sophisticated phishing campaigns that exploit OAuth’s redirect behaviors to deliver malware, specifically targeting government and public-sector organizations. These malicious campaigns cleverly abuse OAuth by creating URLs designed to intentionally trigger error-state redirects, which seamlessly direct victims from trustworthy domains like Microsoft Entra ID or Google Workspace to harmful sites controlled by attackers.
The attackers utilize OAuth URLs with broken parameters such as ‘prompt=none’ and invalid scopes to facilitate these redirects. This approach not only bypasses the traditional advice of checking link destinations before clicking but also demonstrates the evolving complexity of phishing tactics. Initial phishing emails often contain deceptive lures, such as e-signature requests or links to supposed Teams meeting recordings, enticing targets to click and thereby initiate the attack chain.
Upon clicking these links, victims might be directed to platforms like EvilProxy, a phishing-as-a-service solution that can covertly steal credentials, or encounter an automatic download of ZIP files containing LNK shortcut files. These shortcuts, when opened, execute a PowerShell script that not only gathers reconnaissance data but also indirectly loads a malicious DLL through a legitimate executable, ultimately establishing a connection to a command-and-control (C2) server.
Of note, one campaign involved the delivery of a ZIP file with a shortcut that executed PowerShell, marking the precursor to potential ransomware activities. Variants of this campaign also employed adversary-in-the-middle frameworks to capture credentials and multi-factor authentication (MFA) tokens.
In light of these threats, security experts have urged organizations to move away from simplistic defense strategies such as ‘hover and check the link’ and instead adopt more robust measures. These include training employees to assess email context, restricting user consent to third-party OAuth applications, regularly auditing redirect URIs, and avoiding authentication processes initiated from unsolicited emails.
Microsoft has worked to disable the identified malicious OAuth applications, though they caution that such malicious activities persist. They have also provided indicators of compromise and hunting queries for Defender XDR clients. Organizations are advised to remain vigilant, scrutinize OAuth URL lengths, hesitate before interacting with unexpected login prompts, and maintain up-to-date security tools.

Collections

Microsoft has warned of sophisticated phishing campaigns abusing OAuth redirect behaviors to deliver malware, primarily targeting government and public-sector organizations. Attackers craft OAuth URLs with broken parameters like 'prompt=none' and invalid scopes to trigger error-state redirects from trusted domains (Microsoft Entra ID, Google Workspace) to attacker-controlled sites. Victims may be routed through EvilProxy to steal credentials, or tricked into downloading ZIP files containing LNK shortcuts that execute PowerShell scripts, load malicious DLLs, and establish C2 connections. Some variants use adversary-in-the-middle frameworks to capture MFA tokens and may precede ransomware deployment. Security experts recommend moving beyond 'hover to check links,' training staff on email context, restricting third-party OAuth app consent, auditing redirect URIs, and avoiding authentication flows from unsolicited emails. Microsoft has disabled identified malicious OAuth apps and provided indicators of compromise for Defender XDR users.

Exploiting OAuth Redirect Mechanisms in Phishing and Malware Campaigns