Microsoft has warned that attackers are abusing OAuth redirects to deliver phishing and malware via Entra ID and Google Workspace logins.