Amazon Disrupts Russian Hacking Campaign Targeting Microsoft Users

Amazon has disrupted a Russian watering hole campaign targeting Microsoft users by redirecting visitors via compromised websites to attacker-controlled infrastructure. The operation is attributed to the state-sponsored cyberespionage group known as Midnight Blizzard (also tracked as APT29, Cozy Bear, the Dukes, and Yttrium) and believed to be sponsored by the Russian Foreign Intelligence Service (SVR), the article claims.

Attackers injected JavaScript on legitimate sites to push victims toward domains such as findcloudflare[.]com, which mimicked a Cloudflare verification page, prompting users to log into their Microsoft accounts and authorize devices under the attackers’ control through the Microsoft device code authentication flow. Amazon says that only approximately 10% of the compromised site visitors were redirected to the threat actor’s domains.

The defense notes that Midnight Blizzard used randomisation to redirect a small percentage of visitors and hid malicious code with base64 encoding, moving quickly to new infrastructure when blocked; there was no compromise of AWS systems, nor direct impact on AWS services, the company adds. Last year the group impersonated AWS and Microsoft employees to deliver RDP configuration files, and Google warned in June 2025 of further MFA-related tricks targeting Gmail users.