Amazon Stymies APT29 Credential Theft Campaign

Cybersecurity researchers have exposed a sophisticated credential theft campaign attributed to APT29, a group the US government has formally tied to Russia's foreign intelligence service (SVR). The operation compromised legitimate websites to inject malicious code that redirected visitors to fake security verification pages, designed to exploit Microsoft's device code authentication flow and gain access to user accounts.

The campaign included a watering hole tactic described by Amazon’s threat intelligence service, which revealed that attackers even used EC2 instances and tried to migrate infrastructure to another cloud provider before being disrupted. To minimise detection, the attackers randomised redirects so only about 10% of visitors reached attacker-controlled domains, and they employed base64 obfuscation and cookie settings to avoid repeat targeting.

Device code authentication attacks are relatively rare, and, according to Volexity, have proven more effective at compromising accounts than many targeted spear-phishing campaigns, making vigilant logging and conditional-access enforcement essential. 2 September 2025.