There was a big thread on the OAuth mailing list about this a couple of months ago. The official response seems to be "don't use native applications that you think might phish you", which isn't very satisfying.

I'm not sure what the alternative is, though, and OAuth is still a big improvement for the web app client use case.