Russian Actors Abuse Microsoft 365 OAuth Workflows to Phish Accounts
Summary
Volexity describes campaigns by suspected Russian actors UTA0352 and UTA0355 that use targeted social engineering and legitimate Microsoft OAuth workflows to steal authorization codes and access victims’ Microsoft 365 accounts.
Key points
- Since March 2025, UTA0352 and UTA0355 have targeted NGOs, human-rights groups, and people connected to Ukraine using impersonation and one-on-one social engineering via email, Signal, and WhatsApp.
- Victims are directed to legitimate Microsoft login pages and tricked into sharing an OAuth authorization code or the redirected URL, enabling attackers to obtain access tokens.
- UTA0352 abused Microsoft first-party OAuth workflows, including Visual Studio Code redirects, to obtain codes with access to victims’ Microsoft 365 resources.
- UTA0355 used a compromised Ukrainian government email account and targeted the Device Registration Service to add an attacker-controlled device to victims’ Entra ID.
- Volexity observed UTA0355 subsequently persuading a victim to approve a two-factor authentication request, then downloading the victim’s email using the newly registered device.
- Recommended defenses include verifying unexpected contacts out of band, monitoring OAuth and device-registration activity, and considering conditional access restrictions for unmanaged devices.
Article Details
- Attack Vectors
- Targeted social engineering via Signal, WhatsApp, and email, using invitations to Ukraine-related video conferences and impersonated European officials.
- OAuth phishing through legitimate Microsoft 365 authentication workflows, persuading victims to return an authorization code or the redirected URL containing it.
- UTA0355 used a stolen OAuth authorization code to register a device in the victim’s Microsoft Entra ID, then socially engineered approval of a two-factor authentication request to access email.
- Defensive Notes
- Alert on Microsoft 365 login activity using client_id aebc6443-996d-45c2-90f0-388ff96faa56 with a Microsoft Graph resource, and on the described OAuth URL patterns using insiders.vscode.dev/redirect or vscode-redirect.azurewebsites.net.
- Consider the business impact of blocking insiders.vscode.dev and vscode-redirect.azurewebsites.net.
- Train users to verify unexpected contacts out-of-band and never share authorization codes or URLs from browser address bars.
- Monitor for newly registered devices and correlate registration IP addresses with low-reputation or proxy IP addresses; track subsequent activity using the registered deviceId.
- Consider conditional access policies that restrict organizational resources to approved or managed devices.
- Account for the article’s observation that ongoing Microsoft Graph email access may show a Microsoft IP address rather than the attacker’s IP in ClientIPAddress.
MITRE ATT&CK
T1098.005 · Device RegistrationUTA0355 used the authorization code to register a new device in the victim’s Microsoft Entra ID.T1114.002 · Remote Email CollectionAfter obtaining access, the attacker downloaded the target’s email using a session tied to the newly registered device.T1566.002 · Spearphishing LinkThe actors sent OAuth phishing links through messaging applications and, for UTA0355, an initial email followed by messaging-app contact.T1621 · Multi-Factor Authentication Request GenerationUTA0355 induced the victim to approve a two-factor authentication request to gain access to email.T1656 · ImpersonationUTA0352 impersonated European political officials, and UTA0355 used a compromised Ukrainian Government email account to lend credibility to social engineering.
Threat Actors
UTA0352Volexity tracks this suspected actor behind OAuth phishing campaigns impersonating European officials; Volexity assesses with medium confidence that it is Russian.UTA0355Volexity tracks this actor behind an OAuth phishing campaign involving a compromised Ukrainian Government email account and device registration; Volexity assesses with medium confidence that it is Russian.
Vendors
Products
Microsoft 365threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) accounts of targeted individuals.Microsoft Entra IDHowever, in this campaign, the attacker uses the stolen OAuth authorization code to register a new device to the victim’s Microsoft Entra ID (formerly Azure Active Directory) on a permanent basis.Microsoft SharePointIn this interaction, UTA0355 requested that the victim approve a two-factor authentication (2FA) request to “gain access to a SharePoint instance associated with the conference”.Microsoft TeamsIt should also be noted that Microsoft Teams was one of the resources Volexity also observed UTA0352 targeting.Visual Studio CodePhishing via Visual Studio Code
Tools
Countries
BulgariaPermanent Delegation of the Republic of Bulgaria to NATOPolandBased on other observations, Volexity believes UTA0352 also likely impersonated officials from Poland as well, but Volexity did not observe this directly.RomaniaPermanent Representation of Romania to the European UnionUkraineThe attacker contacts the victim via a messaging application (Signal, WhatsApp) and invites them to join a video call to discuss the conflict in Ukraine.