Back Blogs.Microsoft

OAuth redirection abuse enables phishing and malware delivery

Blogs.Microsoft •Microsoft Defender Security Research Team • March 2, 2026

OAuth redirection is being repurposed as a phishing delivery path. Trusted authentication flows are weaponized to move users from legitimate sign‑in pages to attacker‑controlled infrastructure.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Rise of AI-Driven Scams Targeting UK SMEs UK small and medium-sized enterprises (SMEs) are increasingly vulnerable to sophisticated AI-driven scams, as highlighted by recent reports. The emergence of 'AI scams 2.0' combines traditional social engineering techniques with advanced technologies such as automated content creation, voice cloning, and deepfake media. These scams exploit the limited resources of SMEs, which often rely on cloud services and outsourced IT solutions, making them prime targets for fraudsters. A notable method includes 'vishing-as-a-service' platforms that utilize AI-generated voice messages to impersonate trusted institutions, further complicating detection efforts. Industry research indicates that programmatic advertising has surpassed email as the primary channel for malware distribution, accounting for over 60% of phishing campaigns. The sophistication of these attacks allows criminals to personalize messages based on publicly available information, increasing their effectiveness. As a result, SMEs are urged to enhance their cybersecurity measures to combat these evolving threats. 642 sources 62

Extracted Entities

OAuth redirection abuse enables phishing and malware delivery

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (1)