Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

Author(s): Charlie Gardner, Josh Duke, Matthew Meltzer, Sean Koessel, Steven Adair, Tom Lancaster
Organization: Volexity

Open article directly

2026-07-17 ⋅ Volexity ⋅ Sean Koessel, Steven Adair
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
Behinder UTA0533

2025-10-08 ⋅ Volexity ⋅ Callum Roxan, Killian Raimbaud, Steven Adair
APT Meets GPT: Targeted Operations with Untamed LLMs
UTA0388

2025-02-13 ⋅ Volexity ⋅ Charlie Gardner, Steven Adair, Tom Lancaster
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

Propose Change Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows