OAuth redirection abuse enables phishing and malware delivery

Collection of Microsoft Security Blog posts (Feb–Mar 2026) describing multiple active threat trends and defensive guidance. Key issues: OAuth redirection abuse — attackers are weaponizing trusted OAuth sign‑in/redirect flows to deliver phishing and malware via legitimate authentication pages; developer‑targeting via malicious Next.js repositories — poisoned repositories and CI/build workflows can trigger covert RCE-to-C2 chains that hide command-and-control inside normal developer operations; agent and self-hosted runtime risks (OpenClaw-like systems) — durable credentials, untrusted inputs, и