--- title: OAuth phishers make ‘check where the link points’ advice... description: Microsoft has identified a phishing campaign that abuses OAuth's built-in redirect behavior to route victims to malware or credential-harvesting pages, even... canonical: https://daily.dev/posts/oauth-phishers-make-check-where-the-link-points-advice-ineffective-632si65p9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OAuth phishers make ‘check where the link points’ advice ineffective | daily.dev og:description: Microsoft has identified a phishing campaign that abuses OAuth's built-in redirect behavior to route victims to malware or credential-harvesting pages, even... og:url: https://daily.dev/posts/oauth-phishers-make-check-where-the-link-points-advice-ineffective-632si65p9 og:image: https://api.daily.dev/og/posts/632sI65P9.png og:image:alt: OAuth phishers make ‘check where the link points’ advice ineffective og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OAuth phishers make ‘check where the link points’ advice ineffective **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary Microsoft has identified a phishing campaign that abuses OAuth's built-in redirect behavior to route victims to malware or credential-harvesting pages, even though the initial link points to a legitimate identity provider domain like Microsoft Entra ID or Google Workspace. Attackers craft URLs with deliberately broken parameters (using 'prompt=none' and invalid scopes) to trigger error-state redirects to attacker-controlled destinations. One observed campaign delivered a ZIP file containing a malicious shortcut that executed PowerShell and connected to a C2 server in pre-ransomware activity; others used adversary-in-the-middle frameworks like EvilProxy. Security analysts say the classic advice to 'hover and check the link' is now obsolete in this context, and organizations should train employees to validate context rather than URLs, restrict user consent to third-party OAuth apps, audit redirect URIs, and never initiate authentication from unsolicited email links. Microsoft published indicators of compromise and KQL hunting queries for Defender XDR customers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#phishing](https://daily.dev/tags/phishing), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/oauth-phishers-make-check-where-the-link-points-advice-ineffective-632si65p9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OAuth phishers make ‘check where the link points’ advice ineffective","url":"https://daily.dev/posts/oauth-phishers-make-check-where-the-link-points-advice-ineffective-632si65p9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/oauth-phishers-make-check-where-the-link-points-advice-ineffective-632si65p9"},"datePublished":"2026-03-03T13:00:40.174Z","dateModified":"2026-03-04T13:42:07.151Z","description":"Microsoft has identified a phishing campaign that abuses OAuth's built-in redirect behavior to route victims to malware or credential-harvesting pages, even...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3d268c67b0e1a757730c67feb8ac2ff9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3d268c67b0e1a757730c67feb8ac2ff9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/oauth-phishers-make-check-where-the-link-points-advice-ineffective-632si65p9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloud,phishing,oauth","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"OAuth phishers make ‘check where the link points’ advice ineffective"}]} ```