# Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

Russian actors phished M365 OAuth authorization codes via first-party app redirects (VS Code, Device Registration), then registered rogue devices in Entra ID to steal email.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: mindgrub
- Disclosed: 2025-04-22
- Write-up quality: 8/10
- Original: https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
- Library page: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-04-22-phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:chained technique:default-creds vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Microsoft 365 OAuth 2.0 authorize endpoints and Entra ID Device Registration Service
**Root cause:** Legitimate first-party OAuth apps (VS Code redirect, CloudDomainJoin) display or expose authorization codes to users, and the Device Registration Service resource grants a token that can be exchanged for broader Graph API access than intended.
**Steps:**
1. Attacker contacts target via Signal/WhatsApp impersonating a European official and schedules a meeting.
2. Attacker sends a login.microsoftonline.com authorize URL with `client_id=aebc6443-996d-45c2-90f0-388ff96faa56`, `response_type=code`, `redirect_uri=https://insiders.vscode.dev/redirect`, and a spoofed `state` URL.
3. Victim authenticates; VS Code redirect page displays the OAuth authorization code (also in the URI).
4. Attacker asks victim to send the code/URL back via email, WhatsApp, or Signal.
5. Attacker redeems the code for an access token granting the victim's default M365 Graph API rights.
6. For UTA0355: URL uses `client_id=29d9ed98-a469-4536-ade2-f981bc1d605e` with `resource=01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9` and `redirect_uri=https%3A%2F%2Flogin.microsoftonline.com%2FWebApp%2FCloudDomainJoin%2F8`; victim returns the resulting `?code=` URL.
7. Attacker uses the code to join a new device `DESKTOP-[redacted]` to the victim's Entra ID via Device Registration Service.
8. Attacker creates a token with full Graph API permissions (replicated with ROADTools) and social-engineers the victim into approving a 2FA prompt.
9. Attacker downloads the victim's email using a session tied to the registered device, via a proxy IP geolocated near the victim.
**How found:** Volexity observed suspicious Signal/WhatsApp outreach to NGO staff and traced the shared URLs to login.microsoftonline.com, noticing the redirect_uri pointed at first-party VS Code and CloudDomainJoin endpoints that surface authorization codes to users.
**Exploitation:** End-to-end: social engineering over Signal/WhatsApp (or a compromised Ukrainian government email) lures the victim to a genuine Microsoft OAuth URL; the victim authenticates and returns the authorization code shown by the first-party app; the attacker redeems it for tokens, registers a persistent device in Entra ID, obtains a 2FA approval, and exfiltrates email via Graph API.
**Escalation:** UTA0355 chained the OAuth code theft with Entra ID device registration and a follow-up 2FA social-engineering approval to bypass the victim org's MFA requirement and gain persistent email access.
**Insight:** First-party OAuth redirect pages that render the authorization code (insiders.vscode.dev/redirect, vscode-redirect.azurewebsites.net, CloudDomainJoin) turn a benign login into a code-theft primitive; also, requesting the Device Registration Service resource yields a token exchangeable for broader Graph access, and Graph API access logs show Microsoft IPs rather than attacker IPs, so pivot on deviceId and ClientAppID instead.

## Proof of concept (copied exactly from the original report)

**Visual Studio Code OAuth phishing URL**

```
https://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=https://mae.gov[.]ro/[REMOVED]&client_id=aebc6443-996d-45c2-90f0-388ff96faa56&scope=https://graph.microsoft.com/.default&response_type=code&redirect_uri=https://insiders.vscode.dev/redirect&login_hint=<EMAIL HERE>
```

**UTA0355 CloudDomainJoin device registration phishing URL**

```
https://login.microsoftonline.com/common/oauth2/authorize?url=https://teams.microsoft.com/[redacted]&client_id=29d9ed98-a469-4536-ade2-f981bc1d605e&resource=01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9&response_type=code&redirect_uri=https%3A%2F%2Flogin.microsoftonline.com%2FWebApp%2FCloudDomainJoin%2F8&amr_values=ngcmfa&login_hint=<[email protected]>
```

**Earlier v1.0 vscode-redirect phishing URL**

```
hxxps://login.microsoftonline[.]com/common/oauth2/authorize?redirect=https://zoom.us/j/<snip>&client_id=aebc6443-996d-45c2-90f0-388ff96faa56&resource=https://graph.microsoft.com&response_type=code&redirect_uri=https://vscode-redirect.azurewebsites.net&login_hint=<removed>&ui_locales=en-US&mkt=en-US&client-request-id=<removed>
```