An ongoing phishing campaign is abusing the OAuth authentication redirection mechanism to avoid triggering conventional email and browser defenses, Microsoft researchers have revealed. The attackers are targeting government and public-sector organizations, and redirecting unsuspecting users from trusted login pages to their own infrastructure, to serve malware or capture login credentials. The attack, from the victim’s perspective The OAuth authentication redirection mechanism is a trusted login feature used by Microsoft, Google and others. It allows users … More →The post Threat actors weaponize OAuth redirection logic to deliver malware appeared first on Help Net Security.