Russian Threat Actors Target NGOs with New OAuth Phishing Tactics – Source: www.infosecurity-magazine.com

A new wave of targeted phishing attacks exploiting Microsoft 365’s OAuth workflows has been uncovered by cybersecurity experts.

These campaigns, observed by Volexity since March 2025, involve Russian-linked threat actors impersonating European diplomats and Ukrainian officials.

The emails try to lure human rights workers and NGO staff into handing over authentication codes that grant access to their Microsoft accounts.

Sophisticated Social Engineering Behind the Attacks

The threat actors, tracked by Volexity as UTA0352 and UTA0355, are using highly personalized tactics to manipulate targets. Victims receive outreach messages via Signal or WhatsApp, typically appearing to come from European officials proposing meetings on matters related to Ukraine.

These conversations eventually lead to the attacker sending a Microsoft OAuth login link and requesting a code that the user sees after authenticating.

These phishing links redirect users to legitimate Microsoft login pages. However, once the victim returns the displayed code, often via the same messaging platform, the attacker uses it to generate an access token that unlocks the victim’s Microsoft 365 data.

Read more on OAuth attacks: Microsoft nOAuth Flaw Still Exposes SaaS Apps Two Years After Discovery

In one case, UTA0352 directed targets to a version of Visual Studio Code hosted online. There, victims unknowingly triggered the OAuth process and were prompted to send back an authorization code. These codes, valid for up to 60 days, granted access to the user’s Microsoft Graph data, effectively exposing their emails and files.

In another campaign, Volexity discovered UTA0355 using a compromised Ukrainian government email account to send invitations for a fictitious conference. Follow-up messages via messaging apps asked users to authenticate through Microsoft URLs.

Once authenticated, the attackers registered a new device to the user’s Entra ID (formerly Azure AD), bypassed security through social engineering and downloaded email data.

Key Indicators of Compromise

Volexity highlights several signs organizations can monitor for potential compromise, including:

• OAuth login activity using the Visual Studio Code client ID

• URLs with redirects to insiders.vscode.dev or vscode-redirect.azurewebsites.net

• Newly registered devices linked to proxy IP addresses

• Abnormal two-factor authentication approval requests

• App IDs not matching typical user email clients

According to the security firm, the campaigns exclusively target NGOs, think tanks and individuals with connections to Ukraine.

“Based on this, and the use of similar tactics observed in February 2025, Volexity assesses with medium confidence that both UTA0352 and UTA0355 are Russian threat actors,” the advisory reads.

The firm also warned that as these tactics rely solely on Microsoft’s trusted infrastructure and first-party applications, traditional security controls may be ineffective.