Microsoft Details OAuth Error-Flow Abuse in Malware Campaigns
Summary
Microsoft researchers describe campaigns abusing OAuth error redirects to bypass phishing protections and deliver credential theft or malware. The article details EvilProxy phishing and a malware chain involving LNK files, PowerShell, and DLL side-loading.
Key points
- Microsoft says campaigns targeting government and public-sector organizations use lures such as e-signature requests and PDFs.
- Attackers configure malicious OAuth applications with redirect URIs pointing to their infrastructure, then use invalid parameters to trigger silent authentication errors and redirects.
- Some redirects lead to EvilProxy phishing pages that can intercept session cookies and bypass MFA.
- Other redirects deliver ZIP files containing LNK files and HTML-smuggling tools; opening an LNK launches PowerShell and leads to DLL side-loading.
- Microsoft recommends tightening OAuth application permissions, enforcing Conditional Access, and using cross-domain detection across email, identity, and endpoints.
Article Details
- Attack Vectors
- Phishing links in e-signature requests, Social Security notices, meeting invitations, password resets, and financial or political lures use OAuth redirect URLs; some links are embedded in PDFs.
- Attackers register OAuth applications in tenants they control and configure redirect URIs to their infrastructure. Invalid parameters, including an invalid scope or prompt=none, trigger silent authentication errors that redirect victims.
- Some redirects lead to EvilProxy-powered phishing pages that intercept session cookies; misuse of the OAuth state parameter can prefill the victim’s email address.
- Other redirects deliver ZIP files containing malicious .LNK files and HTML-smuggling components. Opening a .LNK launches PowerShell, which performs reconnaissance and enables DLL side-loading to load a payload into memory.
- Defensive Notes
- Tighten permissions for OAuth applications.
- Enforce strong identity protections and Conditional Access policies.
- Use cross-domain detection across email, identity, and endpoints.
MITRE ATT&CK
T1027.006 · HTML SmugglingThe download chain uses HTML smuggling to deliver components alongside malicious .LNK files.T1059.001 · PowerShellThe malicious .LNK launches PowerShell, which performs reconnaissance and extracts components for the next stage.T1105 · Ingress Tool TransferOAuth redirects to a /download path deliver ZIP files containing malicious shortcut files and HTML-smuggling components.T1204.002 · Malicious FileThe chain proceeds when a victim opens a malicious .LNK file delivered in a ZIP.T1539 · Steal Web Session CookieEvilProxy-powered phishing pages intercept valid session cookies to bypass MFA.T1566.002 · Spearphishing LinkPhishing lures contain OAuth redirect links that lead victims toward malicious applications and phishing pages.T1574.002 · DLL Side-LoadingA legitimate executable, stream_monitor.exe, loads a malicious DLL, crashhandler.dll, which decrypts and loads crashlog.dat into memory.