Storm-2372 used the device code phishing technique since August 2024

Microsoft Threat Intelligence attributes a device-code phishing campaign to Storm-2372 (likely Russia-aligned) active since August 2024, targeting governments, NGOs, and multiple industries across regions. The actor lures victims with messaging-app-like invites (e.g., fake Teams), tricks them into entering attacker-generated device codes on legitimate sign-in pages, captures access and refresh tokens, and uses those tokens to access mail and cloud data and move laterally; Microsoft observed shifts in client IDs and proxy use. Recommended mitigations include blocking device code flow, enforcing MFA, and applying least privilege.