Russian State Hackers Exploit Device Code Phishing in Global Cyber Espionage Campaign

A dangerous wave of cyberattacks linked to Russian state-sponsored hackers is sweeping across key industries, compromising government agencies, defense contractors, telecom firms, and other high-value organizations. Microsoft has identified a sophisticated threat actor, tracked as Storm-2372, leveraging device code phishing to infiltrate accounts and exfiltrate sensitive data.

This campaign, active since at least August 2024, has impacted organizations across North America, Europe, the Middle East, and Africa. With the ability to bypass traditional authentication mechanisms, this attack method poses a significant risk to critical infrastructure and national security.

Table of Contents

How Device Code Phishing Works

Device code authentication is a legitimate process used to log into accounts from devices that lack interactive sign-in capabilities, such as smart TVs or IoT devices. Attackers exploit this feature by tricking victims into entering a generated device code on a legitimate login page. Once the target submits the code, the hacker retrieves an access token, granting them unauthorized entry into the victim’s email, cloud storage, and other sensitive systems.

Unlike traditional phishing, device code phishing does not require passwords—instead, it abuses authentication flows to gain persistent access as long as the session tokens remain valid. This allows attackers to move laterally within a compromised network, escalating their privileges and spreading further within an organization.

The Tactics of Storm-2372

Microsoft’s investigation reveals that Storm-2372 has been using highly targeted phishing emails, often disguised as Microsoft Teams meeting invitations, to lure victims into granting access. The group employs social engineering tactics via WhatsApp, Signal, and Microsoft Teams, impersonating influential individuals relevant to their targets. Once rapport is established, the attackers send malicious meeting invitations containing fraudulent authentication requests.

Upon successfully compromising an account, Storm-2372 abuses Microsoft Graph API to scan inboxes for sensitive keywords such as "username," "password," "admin," "credentials," "gov," and "secret." They also exfiltrate emails and use compromised accounts to launch further internal phishing attacks within the organization.

Since February 13, 2025, the hackers have evolved their tactics, using Microsoft Authentication Broker’s client ID to obtain refresh tokens. These tokens allow them to register their own devices within Entra ID, effectively planting a persistent backdoor into compromised networks. To avoid detection, Storm-2372 has also been observed using region-specific proxy servers to disguise their access.

Connections to Other Russian Hacking Groups

Cybersecurity firm Volexity reports that device code phishing has been used to target high-profile entities, including the U.S. State Department, the Ukrainian Ministry of Defense, and the European Union Parliament. In addition to Storm-2372, three other Russia-linked hacking groups—APT29 (Cozy Bear), UTA0304, and UTA0307—have been observed using similar techniques.

While these actors are tracked separately, Volexity suggests they may be part of a single coordinated campaign, orchestrated to gather intelligence from Western governments and strategic institutions.

Mitigation Strategies: Protecting Against Device Code Phishing

Organizations must adopt proactive security measures to defend against this emerging threat. Here’s how:

1. Disable Device Code Authentication (If Not Needed)

If your organization does not rely on device code authentication, disabling it can eliminate the attack vector altogether.

2. Enable Multi-Factor Authentication (MFA)

While device code phishing bypasses passwords, enabling strong MFA methods (such as hardware security keys) can help prevent unauthorized access.

3. Monitor for Unusual Authentication Requests

Security teams should look for suspicious login attempts, especially from unfamiliar locations or devices registered through Entra ID.

4. Educate Employees on Social Engineering

Since attackers use social platforms like WhatsApp and Signal to establish trust, organizations must train employees to recognize impersonation tactics and verify unexpected meeting requests.