Why would a user click a random link from a random source, asking for oauth access to their account somewhere, and then actually provide their credentials and approve it?

Is it a prerequisite that a poisoned agent gives them the link in the current working session, so they think it's related to the session?