Silent OAuth Redirection Probe

Brandon Rodriguez@BMRodriguez

•updated Mar 3, 2026•19•0•179

Detects URL click events or browser launches where the URL targets Microsoft or Google OAuth endpoints and contains the combination of 'prompt=none' and 'scope=invalid'. This specific combination is used by attackers to force a silent error redirect to a malicious URI.