Russian hackers exploit OAuth 2.0 to hack Microsoft 365 Accounts

Russian hackers have exploited professional OAuth 2.0 authentication workflows to hijack Microsoft 365 accounts. Because the cybersecurity area is evolving with time, cyberattackers are attempting completely different measures to focus on their victims.

Not too long ago, a cybersecurity firm, Volexity, found and reported on a sequence of ongoing cyberattacks since March 2025.

Russian hackers goal Ukraine allies by hacking their Microsoft 365 accounts

Two Russian risk actors, tracked as UTA0352 and UTA0355, primarily goal Microsoft 365 accounts of people linked to Ukraine and human rights, utilizing extremely focused social engineering techniques.

Now, you have to be questioning how Russian hackers have been capable of lure the sufferer to fall into their lure, proper? Nicely, the cyber attackers first impersonate themselves as European officers or use hacked Ukrainian authorities accounts to contact victims by way of texting apps like WhatsApp and Sign.

Hackers lure victims into clicking on malicious hyperlinks with none suspicion

Russian hackers lure targets into clicking malicious hyperlinks hosted on Microsoft’s infrastructure or sharing OAuth authorization codes. Legitimate for 60 days, these codes grant victims entry to their electronic mail and different Microsoft 365 assets.

Safety researchers at Volexity word, “It ought to be famous that this code additionally appeared as a part of the URI within the tackle bar. The Visible Studio Code seems to have been set as much as make it simpler to extract and share this code, whereas most different situations would merely result in clean pages.”

In some circumstances, Russian hackers register new units to the sufferer’s Microsoft Entra ID, bypassing two-factor authentication (2FA). They trick customers into approving faux 2FA requests beneath the guise of accessing a SharePoint occasion.

Victims are unlikely to suspect

Since Russian hackers have been utilizing Microsoft’s personal infrastructure, it’s fairly onerous for victims to suspect any foul play. To not point out, these assaults are fairly completely different than conventional phishing. Attackers use proxy networks to imitate the sufferer’s location, making certain that victims don’t suspect something flawed.

The stolen OAuth codes enable extended entry that allows hackers to learn emails, entry information, and preserve unauthorized entry. It’s price noting that every one that is attainable even when victims change their passwords.

Volexity, in its report, notes, “In logs reviewed by Volexity, preliminary gadget registration was profitable shortly after interacting with the attacker. Entry to electronic mail knowledge occurring the next day, which was when UTA0355 had engineered a scenario the place their 2FA request can be authorised.”

All that stated, this isn’t the primary occasion of attackers abusing OAuth authentication workflows. Some current stories highlighted that scammers are even abusing Google OAuth to ship out a number of phishing emails to customers.

Rishaj is a tech author who has been writing professionally for over 4 years, with a ardour for Android, Home windows, and all issues tech. He initially joined Home windows Report as a tech journalist and is now taking up as a information editor. He additionally writes for AndroidHeadlines. Up to now, he has coated options, guides, and listicles for YTECHB and TechieTechTech. When he isn’t breaking the keyboard, you could find him cooking, or listening to music/podcasts.