Microsoft Warns of OAuth Redirect Phishing Targeting Government Organizations

Summary

Microsoft says attackers abuse OAuth redirects to send government and public-sector targets to malicious pages, delivering malware or, in some campaigns, using EvilProxy to intercept credentials and session cookies.

Key points

Attackers create malicious applications with redirect URIs pointing to rogue domains, then send OAuth links using intentionally invalid scopes to trigger redirects.
Lures include e-signature requests, Teams recordings, and political, financial, or social-security themes; links may appear in emails or PDFs.
A reported malware chain uses ZIP archives containing LNK files that launch PowerShell, extract an MSI, and sideload a malicious DLL through steam_monitor.exe.
The DLL decrypts crashlog.dat and runs a final payload in memory that connects to a command-and-control server.
Some campaigns instead use EvilProxy adversary-in-the-middle frameworks to intercept credentials and session cookies.
Microsoft says it removed several identified malicious OAuth applications and advises limiting user consent, reviewing app permissions, and removing unused or overprivileged applications.

Article Details

Event Type: OAuth-based phishing campaigns abuse legitimate redirect functionality to send victims to attacker-controlled pages and deliver malware.
Impact: The campaigns target government and public-sector organizations. Victims may download malware delivered in ZIP archives, leading to PowerShell execution, DLL side-loading, and an in-memory payload that connects to a C2 server. In some campaigns, EvilProxy is used to intercept credentials and session cookies; Microsoft said the OAuth redirect campaigns do not steal tokens.