# Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

Russian actor UTA0355 spoofed European security conferences to lure users into OAuth/device-code phishing, stealing Microsoft 365 tokens and accessing files.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Steven Adair
- Disclosed: 2025-12-04
- Write-up quality: 7/10
- Original: https://www.volexity.com/blog/2025/12/04/dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phishing-attacks/
- Library page: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-12-04-dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phis
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:chained technique:recon vuln:account-takeover vuln:auth-bypass

**Target:** Microsoft 365 OAuth/device-code authentication workflow
**Root cause:** Attackers abused legitimate Microsoft OAuth authorize and device-code flows, creating fake conference registration sites that redirect targeted users to real Microsoft login pages; the resulting token-bearing URL is then handed back to the attacker.
**Steps:**
1. Send spear-phishing email continuing a legitimate thread about a real conference (e.g., Belgrade Security Conference).
2. Direct victim to a Microsoft OAuth URL: `https://login.microsoft[.]com/common/oauth2/authorize?client_id=29d9ed98-a469-4536-ade2-f981bc1d605e&resource=01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9&redirect_uri=https%3A%2F%2Flogin.microsoftonline.com%2FWebApp%2FCloudDomainJoin%2F8&response_type=code&amr_values=ngcmfa&login_hint=[user]`.
3. Victim logs in and lands on a blank page whose URL contains the OAuth token.
4. Attacker asks victim (via WhatsApp/Signal 'live support') to send the URL to 'finalize registration'.
5. Attacker redeems the token, accesses Microsoft 365 files, registers a new Entra ID device named after the victim's existing device, and uses a Xiaomi Android user agent via proxy IPs.
**How found:** Volexity investigated anomalous M365 logins, traced the phishing email to an existing legitimate thread, noticed no email instructions for the returned code, and inferred out-of-band WhatsApp communication; honeypot registration revealed the cookie_reg base64 email and redirect logic.
**Exploitation:** Rapport-building via compromised WhatsApp identities and email threads; fake registration sites (bsc2025[.]org, brussels-indo-pacific-forum[.]org) redirect only interesting corporate domains to real Microsoft login; victim returns token URL; attacker uses token to access M365 files, persists via spoofed Entra device, and routes through residential proxy networks.
**Escalation:** Attacker expanded target list by asking declined invitees for colleague contacts and introductions; reused mailum[.]com registration infrastructure to spin up additional fake-event domains (World Nuclear Exhibition).
**Insight:** When a phishing email asks the victim to 'copy and send the exact URL' from the browser, it signals OAuth code/token phishing — the token lands in the redirect URL fragment/query, so monitor for users pasting login.microsoftonline.com URLs into chat apps and for new Entra device registrations reusing existing device names.

## Proof of concept (copied exactly from the original report)

**Microsoft 365 reprocess phishing redirect URL**

```
https://login.microsoftonline[.]com/common/reprocess?ctx=rQQIARAAJU3P[snipped]m5T2D81&sessionId=941739c9[snipped]2e06bf63f947
```

**WHOIS record of attacker-registered domain**

```
Domain Name: USTRS.COM

Registry Domain ID: 2488656711_DOMAIN_COM-VRSN

Registrar WHOIS Server: whois.dynadot.com

Registrar URL: http://www.dynadot.com

Updated Date: 2025-10-31T14:30:50.0Z

Creation Date: 2020-02-05T03:19:46.0Z

Registrar Registration Expiration Date: 2026-02-05T03:19:46.0Z
```