Advanced Phishing Tradecraft 2026: Anomalous Redirect URI Captures Microsoft Aut

Ibrahim Saud@tektrix

•updated Sep 28, 2026•0•0•2

Detects OAuth2 authorization code flow attempts in Entra ID (Azure AD) sign-in logs where the redirect URI is external to the Microsoft ecosystem, followed by an immediate token issuance event to that same suspicious endpoint. This behavior is indicative of 'ClickFix' or 'ConsentFix' phishing attacks, where users are manipulated into copying an authorization code from a legitimate Microsoft sign-in prompt and pasting it into an attacker-controlled application.