A Digital Watering Hole: How Russia’s APT29 Is Abusing Microsoft Auth Flow

Amazon’s threat intelligence team identified and disrupted a watering hole campaign conducted by APT29 (also known as Midnight Blizzard), a threat actor linked to Russia’s Foreign Intelligence Service (SVR). The operation leveraged compromised websites to redirect unsuspecting visitors into a credential harvesting scheme abusing Microsoft’s device code authentication flow.

According to Amazon, the campaign involved compromising legitimate sites, injecting JavaScript to trick users into authorising attacker‑controlled devices, and redirecting around 10% of visitors to actor‑controlled domains. The group’s tradecraft has evolved, with rapid infrastructure adaptation and a shift from JavaScript redirects to server‑side redirects on new infrastructure, and a history that includes domains impersonating AWS and later activity observed using application‑specific passwords.

Amazon confirmed there was no compromise of AWS systems, nor a direct impact on AWS services. The report notes the current campaign demonstrates scalable tactics that exploit trust in legitimate websites, marking a continuation of APT29’s intelligence‑collection focus with new delivery refinements.