Microsoft Alerts Customers to New Phishing Attack Exploiting OAuth in Entra ID to Bypass Detection

Microsoft recently uncovered sophisticated phishing campaigns that exploit the by-design redirection mechanisms of the OAuth 2.0 protocol.

Threat actors are targeting government and public-sector organizations by manipulating legitimate authentication flows in Microsoft Entra ID and Google Workspace.

Rather than exploiting traditional software vulnerabilities or stealing credentials directly, this campaign abuses trusted protocol behavior to bypass conventional email defenses and silently redirect victims to malicious infrastructure.

OAuth Redirect Abuse Mechanics

The attack sequence begins when an adversary creates a malicious application within their own tenant, setting the redirect URI to a domain hosting malware or phishing frameworks.

Threat actors then mass-distribute phishing emails using social engineering lures, such as e-signature requests, fake Microsoft Teams meeting invites, or password resets.

​

When a victim clicks the provided link, it triggers a silent OAuth authorization flow. Attackers manipulate the URL parameters by specifically using prompt=none and intentionally supplying an invalid scope, such as scope=invalid.

This combination forces the identity provider to evaluate the session and automatically trigger an error redirect without displaying any user interface or interactive prompt.

Because the trusted identity provider handles the redirection, the initial URL appears highly legitimate to both users and security scanners.

​

To increase credibility on the final landing page, threat actors pass the target’s email address through the state parameter using various encoding techniques like Base64, Hex strings, or custom decoder schemes.

Although the state parameter is intended to securely correlate requests and responses, attackers repurpose it to automatically populate the victim’s email on the final phishing page, reinforcing the illusion of a legitimate login session.​

Upon redirection, victims are routed to attacker-controlled destinations. In credential theft scenarios, users land on attacker-in-the-middle toolkits like EvilProxy to intercept session cookies.

Microsoft also uncovered that the malware distribution campaigns, the redirect triggers an automatic download of a ZIP file. This archive typically contains a malicious shortcut file that executes host reconnaissance via PowerShell.

The script then extracts and launches a legitimate binary (steam_monitor.exe) to side-load a malicious DLL (crashhandler.dll), successfully establishing an external command-and-control connection.

​

Mitigation and Threat Identifiers

This activity highlights a broader class of identity-based threats that exploit standard protocol behavior rather than software flaws.

The OAuth specifications, including RFC 6749 and RFC 9700, explicitly define how authorization errors should be handled through redirects.

Section 4.11.2 of RFC 9700 specifically warns that adversaries can deliberately trigger OAuth errors to force an open redirect.

Because these malicious applications are standards-compliant, preventing this activity requires comprehensive protocol governance.​

To defend against these abuses, organizations must implement strict OAuth oversight and leverage cross-domain Extended Detection and Response (XDR) capabilities.

Security teams should actively hunt for URL click events containing invalid OAuth scope parameters and monitor for unusual payload downloads following OAuth error redirects.

Mitigation Category	Recommended Security Action
Application Governance	Limit user consent for OAuth applications and periodically audit overprivileged apps ​.
Access Controls	Implement Conditional Access policies and strictly enforce identity protection measures ​.
Telemetry Monitoring	Deploy cross-domain XDR to correlate email, identity, and endpoint signals ​.
Behavioral Detection	Hunt for PowerShell executions involving shortcut extractions and unexpected DLL side-loading ​.

The following table details key indicators of compromise (IOCs) and detection components associated with this campaign:

Detection Type	Indicator / Component Details	Context
URL Parameters	prompt=none, scope=invalid ​	Used to trigger silent authentication errors ​.
File Artifacts	steam_monitor.exe, crashhandler.dll, crashlog.dat ​	Components used for malicious DLL side-loading ​.
Defender Antivirus	Trojan:Win32/Malgent, Trojan:Win32/Znyonm, Trojan:Win32/WinLNK ​	Defender signatures for the associated malware payloads ​.
Error Codes	Error 65001, error=interaction_required ​	Indicates failed silent SSO and successful redirect ​.

​Security teams should actively hunt for URL click events containing invalid OAuth scope parameters and monitor for unusual payload downloads following OAuth error redirects.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.