UK ties GRU to stealthy Microsoft 365 credential-stealing malware

The UK NCSC attributes a sophisticated credential‑stealing malware family dubbed “Authentic Antics” to APT28 (Fancy Bear); the malware runs inside Outlook to harvest Microsoft 365 credentials and OAuth tokens, exfiltrates data by sending messages from the victim’s own mailbox while disabling “save to sent,” and comprises a dropper, infostealer and PowerShell scripts enabling stealthy, long‑lived access—an attribution that prompted UK sanctions against GRU units and individuals.