Amazon blocks APT29 campaign targeting Microsoft device code authentication

Amazon blocked a Russia-linked APT29 watering hole campaign that hijacked Microsoft device code authentication via compromised sites, according to Amazon. The attackers operated an opportunistic campaign using bogus sites designed to trick visitors into authorising attacker‑controlled devices through Microsoft’s device code authentication flow.

Amazon’s threat intelligence team identified and disrupted the operation, with threat actors injecting obfuscated JavaScript, shifting to server-side redirects, and rapidly adapting infrastructure to continue their efforts. The campaign redirected around 10% of visitors to malicious infrastructure, with domains such as findcloudflare[.]com mimicking legitimate Cloudflare pages and registering additional domains like cloudflare.redirectpartners[.]com to lure victims.

The attackers targeted academics and Russia critics to gather intelligence, and after intervention they moved some activity off AWS to another cloud provider while Amazon and partners blocked malicious domains and isolated affected EC2 instances.