Russia-Linked Hackers Exploit Microsoft 365 Device Code Phishing for Account Takeovers
- Securityish
- Scams & Fraud
Quick Summary
A Russia-aligned group has launched a phishing campaign targeting Microsoft 365 users by exploiting device code authentication workflows. This ongoing attack, tracked as UNK_AcademicFlare since September 2025, primarily affects government, military, and educational organizations in the U.S. and Europe. The attackers use compromised email addresses to lure victims into providing their credentials, leading to potential account takeovers, which poses significant risks to sensitive data and organizational security.
The Securityish Brief
A suspected Russia-aligned group, identified as UNK_AcademicFlare, has been conducting a phishing campaign since September 2025. This campaign targets Microsoft 365 users by utilizing device code authentication workflows to steal credentials and facilitate account takeovers. The attackers primarily focus on government, military, think tanks, higher education, and transportation sectors in the U.S. and Europe.
The phishing attacks involve compromised email addresses that are used to establish rapport with targets before sending a link to a supposed document. This link directs users to a Cloudflare Worker URL that mimics a legitimate Microsoft OneDrive account. Victims are instructed to enter a code that leads them to the actual Microsoft device code login page, where their credentials can be captured.
Proofpoint has linked this activity to other Russia-aligned threat actors, including Storm-2372 and APT29, who have previously employed similar tactics. The campaign has been further fueled by the availability of user-friendly phishing kits like Graphish and tools such as SquarePhish, which lower the entry barrier for less skilled attackers.
This trend highlights a growing risk for organizations, as device code phishing can easily deceive users into providing sensitive information. The implications extend beyond immediate credential theft, as compromised accounts can lead to broader organizational vulnerabilities.
To mitigate these risks, organizations should consider implementing Conditional Access policies to block device code authentication for all users or allow-list specific users and systems. Regular training and awareness programs for employees can also help them recognize phishing attempts and avoid falling victim to such scams.
Key Takeaways
- Implement Conditional Access policies to block device code authentication for all users.
- Train employees to recognize phishing attempts and suspicious emails.
- Regularly review and update security settings for Microsoft 365 accounts.
- Monitor account activity for any unauthorized access or unusual behavior.
- Consider using multi-factor authentication to enhance account security.
Key Terms & Concepts
- Device Code Phishing: In this article, device code phishing refers to a method where attackers trick users into providing authentication codes that allow unauthorized access to their accounts.
- UNK_AcademicFlare: UNK_AcademicFlare is the moniker used by Proofpoint to track a Russia-aligned phishing campaign targeting Microsoft 365 users.
- Graphish: Graphish is a phishing kit that simplifies the process of creating phishing attacks, making it accessible to less skilled threat actors.
- SquarePhish: SquarePhish is a red-team tool designed for phishing attacks that is user-friendly and does not require advanced technical skills.
Read the original article here: https://thehackernews.com/2025/12/russia-linked-hackers-use-microsoft-365.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
