Suspicious OWA Redirect Activity

Ethan Andrews@eandrews

•updated May 20, 2026•12•0•493

Identifies potentially malicious client-side redirects or forced OAuth flows initiating from the Outlook Web Access (OWA) interface, characterized by 302 statuses and redirect parameters. This activity may indicate post-exploitation actions related to CVE-2026-42897.