Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
Summary: Volexity attributes two 2025 phishing campaigns to the Russian threat actor UTA0355, which built fake websites impersonating the Belgrade Security Conference and the Brussels Indo-Pacific Dialogue to lure registrants into Microsoft 365 OAuth and Device Code authentication workflows. In an October 2025 incident, the attacker continued a legitimate email thread, moved the conversation to WhatsApp under two compromised identities tied to the Belgrade conference, and asked the victim to send back the URL containing the OAuth token under the guise of finalizing registration.
Key Takeaway: The attacker did not need malware or a password: a user pasting a URL from their browser bar handed over account access, and Volexity observed follow-on access to Microsoft 365 files coming from a device claiming to be an Android phone while presenting as an iPhone. UTA0355 also asked recipients who declined an invitation to name colleagues who might be interested, and in at least one case an unwitting individual made the introduction, turning a single phishing reply into a wider target list.
Read the original at Volexity Blog ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026