Hackers abuse OAuth 2.0 workflows to hijack Microsoft 365 accounts

Russian-linked threat actors UTA0352 and UTA0355 are conducting targeted OAuth 2.0 phishing campaigns to hijack Microsoft 365 accounts of Ukrainian and human-rights-related organizations by impersonating officials and contacting victims over Signal/WhatsApp. Attackers trick victims into supplying long-lived authorization codes via a Visual Studio Code web landing page and then social-engineer MFA approvals to register devices in Microsoft Entra ID, enabling persistent access; Volexity recommends blocking insiders.vscode.dev and vscode-redirect.azurewebsites.net, monitoring the VS Code client_id, and enforcing conditional access to approved devices.