OAuth redirection abuse enables phishing and malware delivery

This Microsoft Security Blog collection highlights multiple high-risk trends: OAuth redirection abuse is being weaponized to turn trusted authentication flows into phishing and malware delivery paths (attackers abuse legitimate sign‑in redirects to land victims on attacker‑controlled infrastructure); developer‑targeting campaigns are using malicious Next.js repositories and normal build workflows to stage covert RCE→C2 chains; and self‑hosted agents and agentic systems (e.g., OpenClaw‑like setups) introduce identity, isolation, and runtime supply‑chain risks. The feed also publishes defensive,