Since early March 2025, multiple Russia-linked threat actors have been aggressively targeting individuals and organizations with ties to Ukraine and human rights groups. According to Volexity researchers, these sophisticated social engineering operations aim to gain unauthorized access to Microsoft 365 accounts by exploiting legitimate OAuth 2.0 authentication workflows.

## New Attack Techniques

Two distinct threat clusters—UTA0352 and UTA0355—are behind these campaigns, though connections to known groups like APT29 haven’t been ruled out. Unlike previous device code phishing attacks, these operations require direct one-on-one interaction with targets.

The attackers impersonate European officials and, in at least one case, used a compromised Ukrainian Government account to trick victims into sharing Microsoft-generated OAuth codes. They initiate contact through messaging apps like Signal and WhatsApp, inviting targets to:
– Join video calls
– Register for private meetings with European political officials
– Participate in Ukraine-centered events

## Attack Methodology

The attack flow typically follows this pattern:
1. Attackers establish communication and schedule a meeting time
2. As the meeting approaches, they share “instructions” via document
3. They provide a link that redirects to official Microsoft 365 login portals
4. The authentication process generates a Microsoft Authorization Token
5. Victims are redirected to either Visual Studio Code in-browser or a blank page
6. Attackers convince victims to share the displayed OAuth code or URL

UTA0355’s variant adds an additional step: using the stolen OAuth code to register a new device to the victim’s Microsoft Entra ID permanently, followed by a second social engineering attempt to bypass two-factor authentication.

## Mitigation Recommendations

Organizations should:
– Audit newly registered devices
– Educate users about unsolicited messaging platform contacts
– Implement conditional access policies restricting access to approved devices

What makes these attacks particularly challenging to detect is that all user interactions occur on Microsoft’s official infrastructure with no attacker-hosted infrastructure involved. The campaigns leverage Microsoft first-party applications that already have consent granted, making prevention and detection difficult.