Post

@attack.mitre.org

🎣 Get in loser, we’re going phishing. This week, we’re going to spotlight how Russian threat actors are phishing targets associated with Ukraine and human rights to abuse Microsoft OAuth.

30/4/25, 1:22 pm3 reposts10 likes

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

We’re currently reading Volexity’s recent report: “Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows” www.volexity.com/blog/2025/04...

volexity.comPhishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth WorkflowsSince early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

Russian actors have been spotted conducting highly targeted social engineering operations aimed at gaining access to their target’s Microsoft 365 accounts.

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

The adversary contacts a victim via Signal or WhatsApp, invites them to a meeting, and sends them an OAuth phishing URL to join. Once the OAuth code is given up, the threat actor can access the victim’s M365 account.

MITRE ATT&CK

@attack.mitre.org

30 Apr 2025

This behavior maps to T1566.003 Phishing: Spearphishing via Service, a technique in which adversaries send messages through various non-enterprise controlled services in large part because they are more likely to have a less-strict security policy than an enterprise. attack.mitre.org/techniques/T...

attack.mitre.orgPhishing: Spearphishing via Service, Sub-technique T1566.003 - Enterprise | MITRE ATT&CK®