Russian threat actors are exploiting legitimate OAuth 2.0 authentication workflows to compromise Microsoft 365 accounts belonging to employees of Ukraine-related organizations and human rights groups. The attackers impersonate European officials and contact targets through WhatsApp and Signal to trick victims into sharing Microsoft authorization codes or clicking malicious links.
Cybersecurity firm Volexity has monitored this activity since early March, following a similar operation in February that used Device Code Authentication phishing. The company tracks these threat actors as UTA0352 and UTA0355, assessing with medium confidence that both are Russian-backed.
## Attack Methodology
The attack begins with messages via Signal or WhatsApp, sometimes sent from compromised Ukrainian government accounts. Attackers pose as European political officials or Ukrainian diplomats, inviting targets to private video meetings about Ukraine-related matters.
Once communication is established, the attacker sends an OAuth phishing URL disguised as a meeting access requirement. In some cases, they share instructions in PDF format alongside malicious URLs designed to capture Microsoft 365 login credentials.
After authentication, victims are redirected to an in-browser version of Visual Studio Code hosted at insiders.vscode.dev. This page receives login parameters from Microsoft 365, including an OAuth authorization code valid for 60 days that grants access to all user resources.
The attacker then convinces victims to share this code, claiming it’s necessary to join the meeting. In a variation observed in April, UTA0355 used stolen OAuth codes to register new devices to victims’ Microsoft Entra ID accounts and tricked users into approving two-factor authentication requests by claiming they were needed for SharePoint access.
## Protection Recommendations
Volexity advises organizations to:
– Set up alerts for logins using Visual Studio Code client_id
– Block access to ‘insiders.vscode.dev’ and ‘vscode-redirect.azurewebsites.net’
– Implement conditional access policies limiting access to approved devices only