Attackers use crafted OAuth redirect URLs in phishing emails to redirect victims from legitimate Microsoft authentication flows to attacker’sservers.