FlagThis - #microsoft365

Russian threat actors have been actively targeting Microsoft 365 accounts belonging to individuals and organizations with connections to Ukraine and human rights causes. These malicious actors are exploiting legitimate OAuth 2.0 authentication workflows to gain unauthorized access. Researchers at Volexity have been monitoring these campaigns since early March 2025, observing a shift in tactics from previous device code phishing attempts to methods that rely more heavily on direct interaction with targets. These new attacks involve convincing victims to click on links and provide Microsoft-generated codes.

These campaigns involve sophisticated social engineering techniques, where attackers impersonate officials from various European nations and, in one instance, utilized a compromised Ukrainian Government account. The attackers are using messaging apps like Signal and WhatsApp to contact their targets, inviting them to join fake video calls or register for private meetings with European political figures or Ukraine-related events. The goal is to lure victims into clicking links hosted on Microsoft 365 infrastructure, ultimately tricking them into sharing Microsoft Authorization codes.

Volexity is tracking at least two suspected Russian threat actors, identified as UTA0352 and UTA0355, believed to be behind these attacks. The primary tactic involves requesting Microsoft Authorization codes from victims, which then allows the attackers to join attacker-controlled devices to Entra ID (formerly Azure AD) and download emails and other account-related data. This activity demonstrates a continuous effort by Russian threat actors to refine their techniques and circumvent security measures, highlighting the ongoing threat to individuals and organizations associated with Ukraine and human rights.


References :

• cyberpress.org: Cybersecurity firm Volexity has identified a series of sophisticated cyberattacks orchestrated by Russian threat actors abusing Microsoft’s OAuth 2.0 authentication workflows.
• securityonline.info: Russian Hackers Abuse Microsoft 365 OAuth in Sophisticated Phishing Attacks
• The Hacker News: Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp
• www.volexity.com: Volexity blog on Russian Threat Actors Target Microsoft 365 Using OAuth Authorization Code Theft
• Virus Bulletin: Volexity researchers observed multiple Russian threat actors targeting individuals & organizations with ties to Ukraine and human rights. These recent attacks use a new technique aimed at abusing legitimate Microsoft OAuth 2.0 Authentication workflows.
• bsky.app: Russian threat actors have been abusing legitimate OAuth 2.0 authentication workflows to hijack Microsoft 365 accounts of employees of organizations related to Ukraine and human rights.
• Security Risk Advisors: Russian Threat Actors Target Microsoft 365 Using OAuth Authorization Code Theft
• The DefendOps Diaries: Learn how cybercriminals exploit OAuth 2.0 to hijack Microsoft 365 accounts and discover strategies to mitigate these sophisticated threats.
• Email Security - Blog: Detailed analysis of the phishing technique.
• Virus Bulletin: Russian APTs targeting Ukraine supporters with sophisticated Microsoft 365 OAuth phishing.
• www.helpnetsecurity.com: Attackers phish OAuth codes, take over Microsoft 365 accounts
• gbhackers.com: Russian Hackers Exploit Microsoft OAuth 2.0 to Target Organizations
• BleepingComputer: Russian hackers abuse OAuth 2.0 workflows to hijack Microsoft 365 accounts
• Cyber Security News: CyberPress on Russian Hackers Abuse Microsoft OAuth 2.0 to Breach Organizations
• www.sentinelone.com: AI empowers organizations to optimize detection, Russia-nexus actors exploit MS OAuth workflows, and cybercrime hit $16B in losses in 2024.
• slashnext.com: Technical details and vulnerabilities highlighted.
• www.scworld.com: Explanation of the tool used in the attack.

Classification:

• HashTags: #OAuthPhishing #Microsoft365 #RussianAPT
• Company: Microsoft
• Target: Ukraine supporters and human rights organizations
• Attacker: Russian APT
• Product: Microsoft 365
• Feature: OAuth Authorization Code Theft
• Type: Phishing
• Severity: Major

Microsoft is set to block ActiveX controls by default in the Windows versions of Microsoft 365 Apps and Office 2024. This move, announced in April 2025, aims to enhance security by addressing vulnerabilities associated with the legacy software framework. ActiveX controls, introduced in 1996, enabled developers to create interactive objects embedded in Office documents. However, over time, these controls have become a significant point of entry for cybercriminals, similar to macros in Excel, with examples such as the propagation of the TrickBot malware through ActiveX.

Microsoft's decision to disable ActiveX controls by default is part of a broader effort to bolster the security of its products. Since 2018, the company has implemented various measures to block attack vectors exploiting Office applications. These include blocking VBA macros, disabling Excel 4.0 (XLM) macros by default, blocking untrusted XLL add-ins, and phasing out VBScript. The default setting previously was to prompt users before enabling ActiveX, which required users to understand the risks before granting permissions.

When the change is deployed, users will receive a notification stating "BLOCKED CONTENT: The ActiveX content in this file is blocked" if a document contains an ActiveX control. This measure is intended to reduce the risk of malware or unauthorized code execution. Users can re-enable ActiveX controls through the Trust Center, provided administrators have granted them access to the ActiveX settings page. This change is more secure as it blocks the controls entirely.


References :

• The Register - Software: ActiveX blocked by default in Microsoft 365 because remote code execution is bad, OK?
• Will Dormann: Microsoft blocks ActiveX by default in Microsoft 365, Office 2024 About damn time!
• www.bleepingcomputer.com: Microsoft blocks ActiveX by default in Microsoft 365, Office 2024
• IT-Connect: Microsoft : les contrôles ActiveX bientôt bloqués par défaut dans Office et Microsoft 365 Apps
• www.it-connect.fr: Microsoft : les contrôles ActiveX bientôt bloqués par défaut dans Office et Microsoft 365 Apps
• BleepingComputer: Microsoft blocks ActiveX by default in Microsoft 365, Office 2024
• Cyber Security News: Microsoft Disables ActiveX by Default in 365 to Block Malware Execution by Hackers

Classification:

• HashTags: #Microsoft365 #ActiveX #Security
• Company: Microsoft
• Target: Microsoft 365 Users
• Attacker: Microsoft
• Product: Microsoft 365
• Feature: ActiveX Blocking
• Type: ProductUpdate
• Severity: Medium

Multiple Russian threat actors have been identified targeting Microsoft 365 accounts using a device code authentication phishing technique. These attacks, observed since mid-January 2025, involve social engineering and spear-phishing campaigns, often disguised as communications from reputable organizations like the U.S. Department of State and the Ukrainian Ministry of Defence. Volexity has observed these campaigns targeting organizations to compromise Microsoft 365 accounts.

Microsoft Threat Intelligence Center has also discovered an active and successful device code phishing campaign by a threat actor tracked as Storm-2372, active since August 2024. The attacker creates lures that resemble messaging app experiences including WhatsApp, Signal, and Microsoft Teams. Targets include government, non-governmental organizations (NGOs), information technology (IT) services and technology, defense, telecommunications, health, higher education, and energy/oil and gas in Europe, North America, Africa, and the Middle East. Microsoft assesses with medium confidence that Storm-2372 aligns with Russian interests, victimology, and tradecraft.


References :

• www.microsoft.com: Storm-2372 conducts device code phishing campaign
• Volexity :verified:: recently identified multiple Russian threat actors targeting users via + campaigns with Microsoft 365 Device Code authentication (a well-known technique) with alarming success:
• cyberscoop.com: Threat researchers spot ‘device code’ phishing attacks targeting Microsoft accounts
• The Register - Security: If you dread a Microsoft Teams invite, just wait until it turns out to be a Russian phish
• Microsoft Security Blog: Storm-2372 conducts device code phishing campaign
• www.volexity.com: Volexity: Multiple Russian threat actors have been identified targeting Microsoft 365 accounts through Device Code Authentication phishing campaigns, according to Volexity. These attacks, which began in mid-January 2025, involve social engineering and spear-phishing tactics, often masquerading as communications from reputable organizations like the U.S. Department of State and the Ukrainian Ministry of Defence.
• cyberinsider.com: Hackers Use Device Code Phishing to Hijack Microsoft 365 Accounts
• Threats | CyberScoop: Threat researchers spot ‘device code’ phishing attacks targeting Microsoft accounts
• Security Risk Advisors: Attackers Exploit Device Code Phishing to Hijack Microsoft Accounts in Global Storm-2372 Drive
• The Hacker News: Microsoft: Russian-Linked Hackers Using 'Device Code Phishing' to Hijack Accounts
• www.helpnetsecurity.com: Discussion of the ongoing Microsoft 365 campaign.
• www.infosecurity-magazine.com: More details about the ongoing Microsoft 365 campaign.
• arstechnica.com: Russian spies use device code phishing to hijack Microsoft accounts
• securityaffairs.com: Storm-2372 used the device code phishing technique since August 2024
• Christoffer S.: Volexity report on multiple Russian threat actors targeting Microsoft 365 accounts via Device Code Authentication phishing campaigns
• BleepingComputer: An active campaign from a threat actor potentially linked to Russia is targeting Microsoft 365 accounts of individuals at organizations of interest using device code phishing.
• www.bleepingcomputer.com: Microsoft Hackers Steal Emails in Device Code Phishing Attacks
• securityaffairs.com: Russia-linked group Storm-2372 used the device code phishing technique since Aug 2024 to steal login tokens from governments, NGOs, and industries.
• Graham Cluley: Got a Microsoft Teams invite? Storm-2372 gang exploit device codes in global phishing attacks
• Email Security - Blog: Security Alert: Device Code Authentication Phishing Attack

Classification:

• HashTags: #Phishing #DeviceCode #Microsoft365
• Company: Microsoft
• Target: Microsoft 365 users
• Attacker: Russian threat actors
• Product: Microsoft 365
• Feature: Device Code Authentication Phi
• Type: Phishing
• Severity: High