OAuth Redirects Exploited to Deliver Malware
▼ Summary
– Attackers are exploiting OAuth’s redirection mechanism to bypass standard email and browser security by using crafted, invalid authorization requests that trigger error-handling redirects.
– The campaign targets government and public-sector users, redirecting them from legitimate login pages to malicious sites that steal credentials or deliver malware.
– The attack begins with a convincing email containing a link that briefly shows a genuine OAuth sign-in page before silently redirecting to an attacker-controlled site.
– This method blends malicious activity with trusted authentication flows, making it difficult for victims to detect the threat, and persists even after specific malicious OAuth applications are disabled.
– Microsoft recommends organizations mitigate risk by strictly governing OAuth applications, reviewing permissions, and using identity protection with Conditional Access policies.
A sophisticated phishing operation is actively exploiting the OAuth authentication protocol to bypass standard security filters, delivering malware and stealing credentials. Microsoft security researchers have uncovered a campaign targeting government and public-sector entities, where attackers manipulate the trusted OAuth redirect flow to funnel users from legitimate login pages directly to malicious infrastructure. This method effectively camouflages the attack within normal web traffic, making it difficult for both users and conventional email defenses to detect.
From the user’s viewpoint, the attack begins with a convincing email. This message typically contains a link that appears to lead to a genuine Microsoft or Google sign-in page or includes a PDF attachment with such a link embedded. After clicking, the victim is briefly taken to an authentic OAuth login page on a trusted domain, which looks completely normal. However, within seconds, the browser is redirected again, this time to a site controlled by the attackers.
The final destination depends on the specific attack variant. Users might encounter a highly realistic but fraudulent login page engineered to harvest usernames, passwords, or session tokens. Alternatively, the page might automatically initiate the download of a malicious file, often disguised as a ZIP archive or a shortcut file. This file is typically presented as the promised document, meeting recording, or report mentioned in the initial email lure.
The technical crux of this campaign lies in the abuse of OAuth’s error-handling procedures. Attackers craft OAuth authorization requests with intentionally invalid parameters, such as an impossible scope or a “silent authentication” prompt designed to fail. When the identity provider, like Microsoft Entra ID, attempts to process this flawed request, it triggers a standard error response. This response includes a redirect back to a “registered” redirect URI, which the attackers have pre-configured and control.
Researchers note that OAuth flows are designed to redirect users under certain error conditions, a feature the attackers exploit. “Although user interaction is still required to click the link, the redirect path leverages trusted identity provider domains to advance the attack,” the Microsoft team explained. This technique allows them to probe authorization endpoints discreetly and infer information about active user sessions.
The social engineering aspect of these emails is highly effective because the lures mimic everyday business communications. Common themes include invitations to view a shared document, access a Teams meeting recording, review an employee report, validate a Microsoft 365 password, complete an e-signature request, or accept a calendar invite. Attackers have also used themes related to social security, finance, and politics to increase urgency and credibility.
This persistence is a significant concern. Microsoft has confirmed that despite disabling the specific OAuth applications identified in this campaign, related malicious activity continues. This underscores the need for continuous vigilance. To mitigate these risks, organizations are advised to implement strict governance over OAuth applications. Key steps include limiting user consent capabilities, conducting regular reviews of application permissions, and promptly removing any unused or overprivileged apps.
A robust defense requires a layered security approach. Combining these application controls with strong identity protection measures, Conditional Access policies, and cross-domain detection that spans email, identity, and endpoint systems is essential. This multi-faceted strategy helps ensure that trusted authentication mechanisms cannot be easily weaponized for phishing or malware distribution.
(Source: HelpNet Security)
