Notifications
Clear all
Topic starter
31/07/2026 5:13 pm
TL;DR: A novel OAuth redirect abuse technique can be detected by behaviour rather than IOCs, according to Push Security, with a customer true positive arriving months after Microsoft’s initial writeup and after the original indicators had already gone stale. The wider lesson is that browser-based identity abuse requires technique-level hunting, not blocklist maintenance.
NHIMG editorial — based on content published by Push Security: how agentic detection turns OAuth threat intelligence into huntable behaviour
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%).
Questions worth separating out
Q: How should security teams detect OAuth redirect abuse in browser-based phishing campaigns?
A: Focus on the sequence, not the indicator.
Q: Why do static IOCs fail against trusted identity-provider redirect abuse?
A: Because the attack reuses legitimate identity infrastructure as the transport layer, so the visible indicators shift faster than blocklists can keep up.
Q: What do security teams get wrong about OAuth error-handling paths?
A: They often treat them as harmless protocol plumbing instead of as a monitored step in the user journey.
Practitioner guidance
- Prioritise technique-based hunts Build detections around the sequence of an OAuth error followed by an unexpected destination and login behaviour, rather than around a single URL, client ID, or lure.
- Instrument browser telemetry for redirect paths Collect the browser-level events needed to see where an OAuth flow begins, where it errors, and where it lands next.
- Promote validated hunts into standing queries When a behaviour pattern proves precise enough, keep it as a live query rather than a one-off response to a single campaign.
What's in the full article
Push Security's full case study covers the operational detail this post intentionally leaves for the source:
- The exact browser telemetry used to distinguish OAuth error abuse from normal sign-in flows.
- The hunt logic Push used to validate technique-level detections across customer environments.
- The progression from early false negatives to a live query that caught a new variant months later.
- The additional detections added after analysis of the new phishing kit and client-side evasions.
👉 Read Push Security's case study on OAuth redirect abuse detection →
OAuth redirect abuse: what it means for detection teams?
Explore further
31/07/2026 5:13 pm
Technique-level detection is now more valuable than IOC preservation for browser-delivered identity abuse. Static indicators decay the moment a campaign rotates infrastructure, but the delivery behaviour often remains stable. That makes technique extraction the real defensive unit of value for IAM-adjacent detections, especially when trusted OAuth flows are being abused to move users into phishing or malware stages. Practitioners should judge detection maturity by whether it survives campaign churn, not by how many URLs it blocks.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to the State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, which shows how often identity abuse still starts with governance gaps rather than exotic exploit chains.
A question worth separating out:
Q: How can identity teams reduce exposure to redirect-based phishing without relying on blocklists?
A: Use browser-context detections that watch for abnormal post-error transitions, then validate them against internal telemetry before promoting them into standing hunts. That gives teams a control that survives campaign churn and supports faster triage when new variants appear.
👉 Read our full editorial: Technique-level OAuth redirect abuse exposes durable phishing risk
