Topic starter
31/07/2026 5:13 pm
TL;DR: A novel OAuth redirect abuse technique can be detected by behaviour rather than IOCs, according to Push Security, with a customer true positive arriving months after Microsoft’s initial writeup and after the original indicators had already gone stale. The wider lesson is that browser-based identity abuse requires technique-level hunting, not blocklist maintenance.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “From IOCs to TTPs: An agentic threat hunting case study”.
Key questions
Q: What breaks when OAuth redirect abuse is defended only with IOC blocklists?
A: IOC-only defence breaks because the campaign-specific domains, client IDs, and payloads can change while the redirect behaviour stays the same.
Q: Why do trusted identity provider redirects create phishing risk?
A: Trusted redirects create risk because the first hop inherits the reputation of the identity provider, which can hide the malicious second hop from reputation-based controls.
Q: How should security teams detect OAuth redirect abuse in browser-based phishing campaigns?
A: Focus on the sequence, not the indicator.
Practitioner guidance
- Instrument redirect-sequence detections Track the transition from OAuth error pages to login prompts, CAPTCHA gates, or unfamiliar landing pages so behaviour, not domain reputation, drives alerting.
- Separate silent-auth noise from malicious redirects Treat prompt=none and other silent authentication events as baseline noise unless they are paired with an abnormal post-error landing sequence.
- Promote behaviour-based hunts to live queries Convert one-off threat intelligence into standing hunts that look for the same redirect pattern across new lures, domains, and phish kits.
Bottom line: OAuth redirect abuse is durable because the technique survives even when the lure, domain, and payload change.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
31/07/2026 5:13 pm
Technique-level identity abuse outlives campaign-level indicators: OAuth redirect abuse shows why browser-based identity attacks cannot be governed as static IOC problems. The redirect path, not the specific lure, is the repeatable control issue. That shifts the practitioner question from whether a domain is known-bad to whether the authentication flow itself is behaving anomalously.
A question worth separating out:
Q: What should teams do after a redirect-abuse campaign is identified?
A: Teams should turn the observed technique into a standing hunt and correlate it with browser-side telemetry across the estate. The goal is to catch new variants that reuse the same abuse path, even when the domains and payloads are new. That makes the detection resilient instead of campaign-specific.
👉 Read our full editorial: Technique-level OAuth redirect abuse exposes durable phishing risk