Post

MITRE ATT&CK
@attack.mitre.org

🎣 Get in loser, we’re going phishing. This week, we’re going to spotlight how Russian threat actors are phishing targets associated with Ukraine and human rights to abuse Microsoft OAuth.

MITRE ATT&CK
@attack.mitre.org

We’re currently reading Volexity’s recent report: “Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows” www.volexity.com/blog/2025/04...

volexity.comPhishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth WorkflowsSince early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...
MITRE ATT&CK
@attack.mitre.org

The adversary contacts a victim via Signal or WhatsApp, invites them to a meeting, and sends them an OAuth phishing URL to join. Once the OAuth code is given up, the threat actor can access the victim’s M365 account.

MITRE ATT&CK
@attack.mitre.org

The world turns, the seasons change, but Russian threat actors targeting Microsoft 365 accounts stays the same. Earlier this year, the same actors were spotted conducting similar attacks also leveraging chat apps like Signal www.volexity.com/blog/2025/02...

volexity.comMultiple Russian Threat Actors Targeting Microsoft Device Code AuthenticationStarting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack cam...
MITRE ATT&CK
@attack.mitre.org

Signal is a powerful end-to-end encrypted chat app. At the end of the day, that doesn’t help at all when you’re being spearphished. In fact, the lack of visibility and detection inherent in an encrypted chat app could even potentially hurt. That’s a wrinkle requiring vigilance on all parts.

0 reposts1 like

MITRE ATT&CK
@attack.mitre.org

Read Volexity’s reporting here www.volexity.com/blog/2025/04... and be sure to browse the relevant procedures, mitigations, and detections at the ATT&CK technique page: attack.mitre.org/techniques/T...

volexity.comPhishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth WorkflowsSince early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...