Microsoft uncovers OAuth phishing campaigns that abuse login redirects to deliver malware and steal credentials.