AWS catches Russia's Cozy Bear clawing at Microsoft credentials

Amazon disrupted a watering-hole campaign by Russia-linked APT29 that injected obfuscated JavaScript into legitimate websites to redirect a subset of visitors to attacker-controlled domains (e.g., findcloudflare.com, cloudflare.redirectpartners.com) designed to mimic Cloudflare/Microsoft verification pages; the goal was to trick users into entering device codes to authorize attacker-controlled devices and gain access to Microsoft accounts. AWS reported no compromise of its own systems, described APT29's evasion methods (randomized redirects, base64 encoding, cookies, pivoting infrastructure), and linked this activity to prior phishing attempts by the group targeting governments, NGOs, academia, and critics.