Microsoft: OAuth Redirect Abuse Used to Deliver Malware to Government Targets
Microsoft issued a warning on Monday about phishing operations that combine traditional email lures with abused OAuth redirection mechanics to evade common email and browser anti-phishing protections.
According to the Microsoft Defender Security Research Team, threat actors are aiming at government and public-sector entities and rely on OAuth’s intended redirection features rather than exploiting software vulnerabilities or directly harvesting credentials. Instead of capturing tokens, the attackers manipulate OAuth flows to funnel victims to infrastructure controlled by the adversary.
Microsoft explained that identity providers include legitimate redirect capabilities that can send users to specific landing pages in particular flows, such as error-handling or other predefined procedures. Attackers exploit that native behavior by constructing URLs against widely used identity platforms - for example, Entra ID and Google Workspace - using altered parameters or attaching malicious applications so the links look innocuous but ultimately land users on attacker-owned pages.
The campaign begins with the adversary registering a malicious application inside a tenant they control and configuring its redirect URI to point at a hostile domain that hosts the malware. The attackers then distribute an OAuth-based phishing URL asking recipients to authenticate to the fraudulent app using an intentionally invalid scope. That crafted flow causes the victim to be redirected to the attacker’s hosting, which serves a ZIP archive containing the malicious payload.
Once unpacked, the ZIP archive initiates a chain of actions that culminate in infection. The archive contains a Windows shortcut (LNK) that launches a PowerShell command when opened. That PowerShell component performs host discovery and reconnaissance by executing various probe commands. The same LNK extracts an MSI installer from the archive; the installer drops a decoy document to distract the victim while a malicious library named “crashhandler.dll” is sideloaded through a legitimate executable called “steam_monitor.exe.”
After being loaded, the DLL decrypts a file named “crashlog.dat” and runs the final-stage payload directly in memory. This in-memory execution allows the malware to establish outbound communications with an external command-and-control (C2) server, enabling further hands-on-keyboard activity or ransom preparation, Microsoft said.
Microsoft noted that the phishing emails use a variety of topical baits to entice clicks, including electronic signature requests, purported Teams recordings, social security or financial notices, and politically themed messaging. The emails appear to have been distributed using mass-mailing platforms as well as bespoke sending tools developed in Python and Node.js. Phishing links were embedded directly in email bodies or placed inside attached PDF documents.
To make the fake pages seem more legitimate, attackers passed the victim’s email address through the OAuth state parameter using several encoding approaches so that the address would auto-populate on the landing page. The state parameter’s intended purpose is to be a random value that ties request and response together; in these campaigns it was repurposed to ferry encoded recipient email addresses.
Microsoft observed variations across campaigns: some use the redirect abuse purely to deliver malware, while others route victims to phishing platforms such as EvilProxy. Those frameworks act as adversary-in-the-middle (AitM) tools capable of intercepting credentials and session cookies.
As part of its investigation, Microsoft removed a number of the malicious OAuth applications it identified. The company recommends organizations restrict user consent where possible, regularly audit application permissions, and eliminate unused or overly privileged applications to reduce exposure to this tactic.