Microsoft: Hackers abuse OAuth error flows to spread malware

Microsoft Defender observed targeted campaigns abusing legitimate OAuth redirect behavior to force authentication errors and redirect government and public-sector users to attacker-controlled pages. Attackers register malicious OAuth apps, use invalid parameters (e.g., scope, prompt=none) to trigger silent redirects, and funnel victims to phishing pages (EvilProxy) or to ZIP downloads containing .LNK files and HTML smuggling that launch PowerShell, enabling DLL side-loading and in-memory payload execution; defenders are advised to tighten OAuth app permissions, enforce strong identity/Conditional Access policies, and use cross-domain detection across email, identity, and endpoints.