{"id":60249,"date":"2026-03-02T19:29:53","date_gmt":"2026-03-02T19:29:53","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=145415"},"modified":"2026-03-02T19:29:53","modified_gmt":"2026-03-02T19:29:53","slug":"oauth-redirection-abuse-enables-phishing-and-malware-delivery","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/oauth-redirection-abuse-enables-phishing-and-malware-delivery\/","title":{"rendered":"OAuth redirection abuse enables phishing and malware delivery"},"content":{"rendered":"

Microsoft observed phishing-led exploitation of OAuth\u2019s by-design redirection mechanisms. The activity targets government and public-sector organizations and uses silent OAuth authentication flows and intentionally invalid scopes to redirect victims to attacker-controlled infrastructure without stealing tokens. Microsoft Defender flagged malicious activity across email, identity, and endpoint signals. Microsoft Entra disabled the observed OAuth applications; however, related OAuth activity persists and requires ongoing monitoring.<\/em><\/p>\n

\n

Microsoft Defender researchers uncovered phishing campaigns that exploit legitimate OAuth protocol functionality to manipulate URL redirection and bypass conventional phishing defenses across email and browsers. During the investigation, several malicious OAuth applications were identified and removed to mitigate the threat.<\/p>\n

OAuth includes a legitimate feature that allows identity providers to redirect users to a specific landing page under certain conditions, typically in error scenarios or other defined flows. Attackers can abuse this native functionality by crafting URLs with popular identity providers, such as Entra ID or Google Workspace, that use manipulated parameters or associated malicious applications to redirect users to attacker-controlled landing pages. This technique enables the creation of URLs that appear benign but ultimately lead to malicious destinations.<\/p>\n

Technical details<\/h2>\n

The attack begins with the creation of a malicious application in an actor-controlled tenant, configured with a redirect URI pointing to a malicious domain hosting malware. The attacker then distributes a phishing link prompting the target to authenticate to the malicious application.<\/p>\n

Although the mechanics behind OAuth redirection abuse can be subtle, the operational use is straightforward. Threat actors embed crafted OAuth URLs into common phishing lures, relying on user familiarity with legitimate authentication flows to encourage interaction. To clarify the sequence, the attack is broken down into stages below, starting with delivery and the initial user interaction that triggers the redirection chain.<\/p>\n

<\/figure>\n

Stage 1: Email delivery<\/h3>\n

Several threat actors distributed phishing campaigns containing OAuth redirect URLs. The emails used e-signature requests, social security, financial, and political themes to entice recipients to engage and click the link. Indicators suggest these actors used free prebuilt mass-sending tools as well as custom solutions developed in Python and Node.js. In some cases, cloud email services and cloud-hosted virtual machines were used to distribute the messages.<\/p>\n

Most URLs were embedded directly in the email body, but some actors placed the URL and accompanying lure inside a PDF attachment and sent the email with no body content. After the OAuth redirect, some campaigns routed users directly to a phishing page, while others introduced additional verification steps designed to bypass security controls.<\/p>\n

We observed misuse of OAuth redirects in both phishing and malware distribution campaigns. To increase credibility, actors passed the target email address through the state<\/code> parameter using various encoding techniques, allowing it to be automatically populated on the phishing page. The state<\/code> parameter is intended to be randomly generated and used to correlate request and response values, but in these cases it was repurposed to carry encoded email addresses. Observed encoding methods included:<\/p>\n