Russian APT UTA0355 Steals Microsoft 365 OAuth Tokens via Fake Security Conference Lures and WhatsApp Support

A new report from Volexity details a targeted phishing campaign by the Russian threat actor UTA0355, which impersonates prestigious international security conferences to steal Microsoft 365 OAuth tokens. The operation relies on polished fake event sites for events such as the Belgrade Security Conference and the Brussels Indo-Pacific Dialogue, with attackers building rapport weeks in advance and sending a phishing link only after interest is confirmed.

To deepen trust, the group provides “live support” via messaging apps like WhatsApp and Signal to guide victims through authentication steps, bypassing suspicion. The attack leverages Microsoft’s OAuth and Device Code workflows, tricking victims into authorising a malicious application or device; when a user registers for a conference, they are redirected to a legitimate Microsoft login page, but the workflow is manipulated to generate a token for the attacker.

The campaign has also been observed using compromised accounts from within legitimate organisations to launch these attacks, increasing the credibility of the phishing content, according to Volexity. December 8, 2025.