Security researchers at Volexity have uncovered multiple Russian threat actors conducting sophisticated social engineering and spear-phishing campaigns targeting Microsoft 365 accounts through Device Code Authentication exploitation. The threat actors impersonate officials from organizations like the US Department of State, Ukrainian Ministry of Defence, and European Parliament to lure victims into authenticating through Microsoft’s Device Code workflow. In one notable campaign, UTA0304 used a custom Element server (sen-comms[.]com) to coordinate real-time communication with victims, ensuring they entered the device code within the 15-minute validity window. While the security analysts at Volexity detected that this legitimate feature, typically used for IoT devices and smart TVs, is being weaponized to gain unauthorized access to M365 accounts. Organizations are advised to evaluate their Device Code Authentication usage and implement appropriate monitoring and blocking measures. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Organizations can protect themselves by implementing conditional access policies to block Device Code Authentication.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 17 Feb 2025 10:00:16 +0000