Attackers abuse OAuth’s built-in redirects to launch phishing and malware attacks

Researchers report attackers are abusing OAuth error redirects from major providers (Microsoft, Google) by initiating silent, intentionally failing authorization flows that cause the identity provider to redirect victims to attacker-controlled sites; from there attackers either present phishing/AitM pages to harvest credentials and MFA or deliver malware via automatic downloads, enabling account takeover or endpoint compromise.