Microsoft Warns of New Phishing Attack Exploiting OAuth in Entra ID to Evade Detection

An active phishing attack has been identified exploiting OAuth's legitimate redirection behavior. This method enables attackers to bypass traditional email and browser defenses without the need to steal tokens.

Microsoft Defender researchers report that these campaigns mainly target government and public-sector organizations, utilizing trusted identity provider domains to disguise malicious redirects.

This technique differs from traditional phishing as it abuses OAuth’s standard error-handling flows, as specified in RFC 6749, instead of relying on credential theft or software exploits.

Attackers register malicious applications within actor-controlled tenants, configuring redirect URIs that lead to attacker-owned domains. Phishing links are distributed to initiate a silent OAuth authorization flow.

The URLs crafted for this purpose target Microsoft Entra ID’s /common/oauth2/v2.0/authorize endpoint using specific parameters:

/common/ : Targets all tenants for broad impact. response_type=code : Triggers the full OAuth authentication logic. prompt=none : Enables silent authentication without user interaction. scope=<invalid_scope> : Ensures failure to force an error redirect path.

The request is designed to fail, prompting the identity provider to silently assess session state and Conditional Access policies before redirecting the browser to the attacker's registered URI. No access token is stolen; the primary objective is redirection to malicious infrastructure, as detailed in a report by Microsoft.

Threat actors send phishing emails themed around e-signatures, Social Security notices, Teams meetings, and financial documents. Some campaigns embed OAuth redirect URLs directly, while others hide them within PDF attachments. Mass-sending tools built with Python and Node.js, along with cloud-hosted virtual machines, facilitate the distribution.

Clicking the phishing link initiates the crafted OAuth authorization flow. The state parameter is repurposed to include the victim’s encoded email address, using various encoding schemes, to auto-populate the phishing landing page.

When silent authentication fails, Entra ID returns an error code 65001 (interaction_required), redirecting the browser to the attacker’s URI. This confirms account existence and the necessity for interactive MFA, providing valuable intelligence to the attacker, even without a stolen token.

Post-redirect, victims are led to phishing frameworks like EvilProxy, which act as attacker-in-the-middle toolkits to intercept credentials and session cookies. In targeted campaigns, a ZIP file is automatically downloaded, containing LNK shortcut files and HTML smuggling loaders.

Executing the ZIP file runs a PowerShell command for host reconnaissance ( ipconfig /all , tasklist ), followed by DLL side-loading via a legitimate steam_monitor.exe binary. The malicious crashhandler.dll decrypts a payload in memory and establishes a C2 outbound connection.

Organizations are advised to implement the following defensive measures:

Restrict user consent to OAuth applications through Entra ID admin consent policies. Audit and remove unused, overprivileged, or unrecognized OAuth app registrations. Enable Conditional Access policies and identity protection controls. Deploy cross-domain XDR detections spanning email, identity, and endpoint signals. Monitor OAuth redirect URIs for signs of suspicious or newly registered domains.

Microsoft Entra has disabled the observed malicious OAuth applications, but ongoing vigilance is required as related OAuth abuse activity continues to be detected. As organizations fortify MFA and credential defenses, adversaries are increasingly exploiting trust relationships within authentication protocols.

Based on reporting by Cyber Security News.