Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

Volexity reports that Russian-linked threat actor UTA0355 conducted multiple targeted phishing campaigns in 2025 abusing Microsoft OAuth and Device Code authentication flows to trick users registering for fake conference websites into providing authentication codes; attackers used rapport-building, compromised identities, professional-looking decoy sites, and messaging apps to guide victims, gained persistent access to Microsoft 365 accounts, and operationalized proxy infrastructure—Volexity provides examples, domains, and IOCs.