OAuth redirection abuse enables phishing and malware delivery

Microsoft Security Blog posts (Feb–Mar 2026) describe multiple active and emerging risks: OAuth redirection abuse is being weaponized to convert trusted authentication flows into phishing and malware delivery vectors; developer-targeting campaigns abuse malicious Next.js repositories to achieve covert RCE→C2 via standard build workflows; and self‑hosted agents (OpenClaw‑like systems) and agent misconfigurations create dual supply‑chain and runtime exposure. The feed also covers defensive guidance and operational responses—threat modeling for AI apps, detections and mitigations for agent mis配置,