ºÚÁÏÕýÄÜÁ¿

The Microsoft Threat Intelligence Center has identified an active device code phishing campaign conducted by a group known as Storm-2372, which has been operational since August 2024. This threat actor targets various sectors, including government, NGOs, IT, defense, telecommunications, health, education, and energy across Europe, North America, Africa, and the Middle East. Microsoft has assessed with medium confidence that this threat actor might be linked to Russia.

The campaign includes sending phony meeting invitations via email, mimicking Microsoft Teams, and prompting users to authenticate using a device code generated by the threat actor. Once a victim authenticates, the attackers leverage the obtained access tokens to infiltrate the network further.