Microsoft Warns of OAuth Redirect Abuse in Phishing Campaigns

Microsoft has issued a warning regarding ongoing phishing campaigns that exploit OAuth URL redirection mechanisms to bypass traditional security measures. These attacks primarily target government and public-sector organizations, aiming to redirect victims to malicious infrastructure without the need to steal access tokens. The Microsoft Defender Security Research Team described these phishing attacks as identity-based threats that leverage OAuth's legitimate features rather than exploiting software vulnerabilities.

The Register UKMicrosoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

The attacks begin with the creation of a malicious application by threat actors within their controlled tenant. This application is configured with a redirect URL that points to a rogue domain hosting malware. Attackers distribute OAuth phishing links that prompt users to authenticate with the malicious application using intentionally invalid parameters. This redirection leads to the inadvertent download of malware onto victims' devices. The malicious payloads are typically packaged in ZIP archives, which, when unpacked, execute PowerShell commands to conduct reconnaissance on the host machine and facilitate further malicious activities.

Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government TargetsThe Register UK

Phishing emails are sent using mass-sending tools and custom solutions developed in programming languages such as Python and Node.js. The malicious URLs are embedded directly in the email body or included within PDF attachments. To enhance credibility, attackers manipulate the state parameter to automatically populate the target email address on the phishing page, a tactic that misuses the intended functionality of OAuth.

Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

The payloads delivered through these phishing campaigns include ZIP files containing Windows shortcut (LNK) files that execute PowerShell commands upon opening. These commands are designed to gather information about the victim's system and sideload a malicious DLL file named "crashhandler.dll" using a legitimate executable, "steam_monitor.exe." This DLL then decrypts another file, "crashlog.dat," and executes the final payload in memory, establishing a connection to an external command-and-control (C2) server.

The Register UKMicrosoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

Microsoft has taken steps to mitigate these threats by removing several identified malicious OAuth applications. The company advises organizations to limit user consent, regularly review application permissions, and eliminate unused or overprivileged applications to enhance security against such phishing attempts.

Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

Despite Microsoft's actions, the company acknowledges that related OAuth activity persists and requires ongoing monitoring. Critics have raised concerns about the effectiveness of current security measures against these evolving phishing tactics, emphasizing the need for more robust defenses.

The Register UK

While Microsoft has provided detailed insights into the nature of these phishing campaigns, the company has not disclosed the size or scope of the attacks, leaving a gap in understanding the full impact of the threat.

The Register UK

• "OAuth includes a legitimate feature that allows identity providers to redirect users to a specific landing page under certain conditions." — Microsoft Defender Security Research Team

The Register UK

• "Indicators suggest these actors used free prebuilt mass-sending tools as well as custom solutions developed in Python and Node.js." — Microsoft

The Register UK

• "By hosting the payload on an application redirect URI under their control, attackers can quickly rotate or change redirected domains when security filters block them." — Microsoft

The Register UK