UNK_AcademicFlare

No known aliases in database

▲ High Threat

M365 Device Code Phishing Campaign

Origin Russia

Sponsor Russia (suspected state-aligned)

Motivation Espionage

Target Sectors

Government Think Tanks Higher Education Transportation Energy

OAuth Device Code Phishing

Rapport Building via Benign Outreach

Use of Compromised Government/Military Email Accounts

Cloudflare Worker URL Spoofing (OneDrive Mimicry)

M365 Account Takeover

MFA Bypass via OAuth Token Theft

CISA Advisories ↗

Hacking the mainframe…