Search

    Language Settings
    Select Website Language

    GDPR Compliance

    We use cookies to ensure you get the best experience on our website. By continuing to use our site, you accept our use of cookies, Privacy Policy, and Terms of Service.

    Microsoft Flags New OAuth-Based Phishing Attack Targeting Public Sector

    1 hour ago

    A new phishing campaign has been discovered that uses a clever trick inside the OAuth login system. Security researchers from Microsoft Defender say attackers are abusing the normal redirection feature of OAuth to send users to malicious websites. Unlike traditional phishing attacks that try to steal passwords or tokens directly, this method works differently. It triggers an error in the authentication process, so the system automatically redirects the victim’s browser. 

    The campaign mainly targets government and public-sector organisations. Because the links use trusted identity provider domains, many security filters fail to detect the attack easily.

    New OAuth Phishing Attack Uses Redirect Trick

    This new OAuth phishing attack works by abusing the normal error-handling process defined in the OAuth standard. Attackers first register fake applications inside their own cloud tenants. They then configure redirect links that lead to domains they control.

    Phishing emails are sent with special OAuth authorisation links. These links target the Microsoft Entra ID login endpoint and include parameters designed to break the login process. For example, attackers request an invalid permission, so the authentication attempt fails.

    When the request fails, the identity system automatically redirects the browser to the attacker’s registered redirect link. Since this redirect is part of normal OAuth behaviour, many email and browser security systems do not block it.

    Five-Stage Phishing Attack Chain Explained

    Researchers say the campaign follows a five-stage phishing attack chain. First, attackers send phishing emails related to e-signatures, financial documents, or meeting invites. Automated tools help them send large numbers of messages.

    Second, clicking the link triggers a silent OAuth check. The link may also contain the victim’s encoded email address.

    Third, the authentication request fails, and the system redirects the user to the attacker’s website. Fourth, victims may be taken to phishing pages or prompted to download malicious ZIP files.

    Finally, malware can run PowerShell commands, collect system information, and connect to attacker-controlled servers.

    Click here to Read More
    Previous Article
    Toxic release delayed to 2026: Yash cites Middle East tensions; fans say move helps both films
    Next Article
    Silver Prices Climb Amid US-Iran Tensions (Mar 4), Check 1 Gram And 1 Kg Rates In Major Cities Across India

    Related Technology Updates:

    Are you sure? You want to delete this comment..! Remove Cancel

    Comments (0)

      Leave a comment