Microsoft warns of OAuth phishing campaigns able to bypass email and browser defenses - says 'these campaigns demonstrate that this abuse is operational, not theoretical'

A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system.

---

• Microsoft warns hackers are abusing OAuth redirect feature to deliver malware
• Phishing emails themed around Teams recordings or 365 resets redirect victims to attacker-controlled sites
• Payloads dropped via ZIP archives with LNK shortcuts and HTML smuggling; final stage connects to external C2