Microsoft Details OAuth Redirect Abuse in Phishing and Malware Campaigns

Mar 3, 2026 · Original article ↗

Summary

Microsoft researchers describe campaigns abusing silent OAuth flows and error redirects to send government and public-sector users to phishing or malware pages. One observed chain used a ZIP, LNK, PowerShell and DLL side-loading; Microsoft provides detection and mitig

Key points

Attackers used OAuth authorization requests with parameters such as prompt=none and invalid scopes to trigger redirects to attacker-controlled landing pages.
Phishing lures arrived through email links, PDFs and fake calendar invites; attackers also used the OAuth state parameter to pass encoded target email addresses.
Some redirects led to phishing frameworks such as EvilProxy; others delivered ZIP archives containing LNK files and HTML smuggling loaders.
In one observed malware-delivery chain, a LNK launched PowerShell, which extracted steam_monitor.exe, crashhandler.dll and crashlog.dat; the DLL decrypted and executed a payload in memory.
Microsoft says the silent OAuth flow did not yield access tokens, and Microsoft Entra disabled the observed malicious OAuth applications; related redirect activity continued.
Microsoft recommends governing OAuth apps and consent, using Conditional Access and cross-domain detection, and provides Defender hunting queries for related activity.

Article Details

Attack Vectors: Phishing emails and PDF attachments carried crafted OAuth authorization URLs that used prompt=none and invalid scopes to trigger redirects to attacker-controlled landing pages.
Fake .ics calendar invitations and social-engineering lures involving document sharing, payroll, Social Security, Teams meetings, and password resets encouraged user interaction.
Attackers repurposed OAuth state parameters to pass target email addresses, including in plaintext or encoded forms, for automatic population on phishing pages.
Some redirects led to EvilProxy phishing infrastructure; another campaign delivered ZIP archives containing LNK shortcuts and HTML smuggling loaders.
Opening a malicious LNK executed PowerShell for host reconnaissance and archive extraction. The legitimate steam_monitor.exe then side-loaded crashhandler.dll, which decrypted and executed crashlog.dat in memory before connecting to an external C2 endpoint.
Defensive Notes: Govern OAuth applications: limit user consent, review application permissions regularly, and remove unused or overprivileged applications.
Use Conditional Access and identity protection, and correlate detections across email, identity, and endpoint signals.
Block known IOCs and monitor email and authentication URLs for prompt=none, invalid scopes, encoded email addresses in state parameters, and unexpected post-authentication redirects.
Hunt for the reported PowerShell, archive extraction, steam_monitor.exe, and crashhandler.dll activity using the article's provided Microsoft Defender XDR queries.

Indicators of compromise

Type	Indicator	Context
URL	`hxxps[:]//abv-abc3[.]top/abv2/css/red[.]html`	Attacker-controlled redirect landing URL listed among initial redirection indicators.
URL	`hxxps[:]//calltask[.]im/cpcounting/via-secureplatform/quick/`	Attacker-controlled redirect landing URL identified in the campaign's indicators.
URL	`hxxps[:]//dynamic-entry[.]powerappsportals[.]com/dynamics/`	Attacker-controlled OAuth redirect landing URL listed among initial redirection indicators.
URL	`hxxps[:]//email-services[.]powerappsportals[.]com/divisor/`	Attacker-controlled OAuth redirect landing URL listed among initial redirection indicators.
URL	`hxxps[:]//gbm234[.]powerappsportals[.]com/auth/`	Attacker-controlled OAuth redirect landing URL listed among initial redirection indicators.
URL	`hxxps[:]//login-web-auth[.]github[.]io/red-auth/`	Specific attacker-controlled phishing redirect URL listed among initial redirection indicators.
URL	`hxxps[:]//memointernals[.]powerappsportals[.]com/auth/`	Attacker-controlled OAuth redirect landing URL listed among initial redirection indicators.
URL	`hxxps[:]//mweb-ssm[.]surge[.]sh`	Specific attacker-controlled landing host listed among initial redirection indicators.
URL	`hxxps[:]//ouviraparelhosauditivos[.]com[.]br/auth/entry[.]php`	Attacker-controlled redirect landing URL listed among initial redirection indicators.
URL	`hxxps[:]//ssmapp[.]github[.]io/web`	Specific attacker-controlled landing URL listed among initial redirection indicators.
URL	`hxxps[:]//ssmview-group[.]gitlab[.]io/ssmview`	Specific attacker-controlled landing URL listed among initial redirection indicators.
URL	`hxxps[:]//weds101[.]siriusmarine-sg[.]com/minerwebmailsecure101/`	Attacker-controlled redirect landing URL listed among initial redirection indicators.
URL	`hxxps[:]//westsecure[.]powerappsportals[.]com/security/`	Attacker-controlled OAuth redirect landing URL listed among initial redirection indicators.