How Attackers Weaponize Trusted Identity Endpoints
Threat actors are increasingly exploiting OAuth’s error-handling behavior to route phishing victims through login.microsoftonline.com and accounts.google.com. By crafting URLs that are designed to fail, attackers can silently redirect users to malicious infrastructure.
prompt=none and an invalid scope to force an immediate redirect without the victim seeing a single Microsoft or Google UI element.Anatomy of a Malicious Authorization Request
?client_id=<attacker_app_id>
&prompt=none
&scope=INVALID_SCOPE
&response_type=code
&redirect_uri=https://attacker-c2.com/phish
Detection & Mitigation Strategies
- Monitor for Error 65001: Audit Entra ID sign-in logs for
resultType = 65001involving unknown application IDs. - Restrict User Consent: Disable user-led consent for multi-tenant applications or restrict it to “Verified Publishers” only.
- Analyze State Parameters: Inbound emails containing OAuth URLs where the
stateparameter decodes to a victim’s email address are high-confidence indicators of phishing.
MITRE ATT&CK Mapping
| Technique ID | Name | Context |
|---|---|---|
| T1566.002 | Spearphishing Link | Malicious OAuth URLs in emails. |
| T1557 | Adversary-in-the-Middle | Credential theft via EvilProxy. |
| T1574.002 | DLL Side-Loading | Execution via steam_monitor.exe. |
About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.