Amazon disrupts Russian APT29 hackers targeting Microsoft 365

Researchers have disrupted an operation attributed to the Russian state-sponsored threat group Midnight Blizzard, also known as APT29, which sought access to Microsoft 365 accounts and data. The watering hole campaign compromised multiple legitimate websites and used obfuscated code to redirect visitors to attacker-controlled domains, with roughly 10% of victims being sent to pages that mimic Cloudflare verification sites.

Victims entering the fake Cloudflare pages were guided into a malicious Microsoft device code authentication flow in an attempt to trick them into authorising attacker-controlled devices. Amazon notes that investigators isolated the EC2 instances the threat actors used and partnered with Cloudflare and Microsoft to disrupt the identified domains, while CJ Moses, Amazon's Chief Information Security Officer, said researchers continued to track the group’s movement and disrupted the effort.

The action, announced on 1 September 2025, marks an evolution in APT29’s approach to credential harvesting and intelligence gathering, with refinements that move away from sometimes relied-upon AWS-impersonating domains or MFA-bypassing social engineering. according to Amazon.