Post

🎣 Get in loser, we’re going phishing. This week, we’re going to spotlight how Russian threat actors are phishing targets associated with Ukraine and human rights to abuse Microsoft OAuth.

MITRE ATT&CK

@attack.mitre.org

We’re currently reading Volexity’s recent report: “Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows” www.volexity.com/blog/2025/04...

volexity.comPhishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth WorkflowsSince early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...

30/4/25, 1:22 pm1 repost2 likes

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

Russian actors have been spotted conducting highly targeted social engineering operations aimed at gaining access to their target’s Microsoft 365 accounts.

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

The adversary contacts a victim via Signal or WhatsApp, invites them to a meeting, and sends them an OAuth phishing URL to join. Once the OAuth code is given up, the threat actor can access the victim’s M365 account.

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

This behavior maps to T1566.003 Phishing: Spearphishing via Service, a technique in which adversaries send messages through various non-enterprise controlled services in large part because they are more likely to have a less-strict security policy than an enterprise. attack.mitre.org/techniques/T...

attack.mitre.orgPhishing: Spearphishing via Service, Sub-technique T1566.003 - Enterprise | MITRE ATT&CK®

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

The world turns, the seasons change, but Russian threat actors targeting Microsoft 365 accounts stays the same. Earlier this year, the same actors were spotted conducting similar attacks also leveraging chat apps like Signal www.volexity.com/blog/2025/02...

volexity.comMultiple Russian Threat Actors Targeting Microsoft Device Code AuthenticationStarting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack cam...