Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows
Summary: Since early March 2025, Volexity has tracked at least two suspected Russian threat actors, UTA0352 and UTA0355, running targeted social engineering against Microsoft 365 accounts by abusing legitimate OAuth 2.0 authentication workflows rather than Device Code Authentication phishing. UTA0352 impersonated European political officials to staff at NGOs working on Ukraine, sending login.microsoftonline.com links that generated OAuth authorization codes valid for up to 60 days, while UTA0355 sent invitations from a compromised Ukrainian Government email account and used the stolen code to register a device in the victim's Entra ID, then socially engineered approval of a two-factor authentication request.
Bottom line: The links point at Microsoft's real login portal and the codes grant access to everything the user can reach, so a single code sent back over WhatsApp or Signal hands over the account without any malware or credential theft. UTA0355's device registration in Entra ID is permanent, meaning the access can outlast the initial conversation and the two-factor prompt the target was talked into approving.
Read the original at Volexity Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026