OAuth authorize redirect_uri parameter pointing to attacker .vu infrastructure

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•1

This rule detects anomalous OAuth authorization requests to Microsoft and Google services where the 'redirect_uri' parameter points to suspicious external domains (specifically ending in .vu) or, in the case of silent Microsoft OAuth requests, points to domains outside of recognized Microsoft/Office 365 infrastructure. Such abuse is often indicative of OAuth consent phishing campaigns designed to steal application access tokens.