Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Summary: Starting in mid-January 2025, Volexity identified spear-phishing and social-engineering campaigns by Russia-based threat actors targeting Microsoft 365 accounts, all using Device Code Authentication to gain long-term account access. Volexity tracks the activity under three threat actors - UTA0304, UTA0307, and CozyLarch (assessed with medium confidence, overlapping with APT29 and Midnight Blizzard) - and in one case the attacker moved a victim from Signal to an attacker-controlled Element server at sen-comms[.]com before sending a fake meeting invite whose links pointed to the Microsoft device-auth page.
Why it matters: Device codes are valid for only 15 minutes, so the attackers used real-time chat to walk victims through the phish - and Volexity reports this method has been more effective at compromising accounts than most other targeted spear-phishing campaigns, with one confirmed breach followed by a scripted OneDrive file download from VPS and Tor IPs.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026