Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers

A Russia-aligned threat group has been attributed to a device-code phishing campaign that aims to steal Microsoft 365 credentials and enable account takeovers, with activity ongoing since September 2025. Proofpoint, which tracks the operation under UNK_AcademicFlare, says the attacks target government and military‑affiliated organisations in the US and Europe, using compromised email addresses to conduct outreach and build rapport before arranging a fictitious meeting.

In the campaigns, the adversary shares a link to a document that instructs victims to copy a code and click Next; the link points to a Cloudflare Worker URL that mimics the compromised sender’s Microsoft OneDrive, and redirects the user to the legitimate Microsoft device code login URL to generate an access token for takeover.

Device code phishing was documented in February 2025 by Microsoft and Volexity as being used by Russia-aligned clusters such as Storm-2372, APT29, UTA0304 and UTA0307, with TA2723 also cited as using similar lures. To counter the threat, Proofpoint recommends blocking the device code flow with a Conditional Access policy or applying an allow‑list approach for approved users, operating systems or IP ranges.