Amazon disrupts Russian APT29 hackers targeting Microsoft 365

Researchers disrupted a watering-hole campaign attributed to Russian APT29 (Midnight Blizzard) that injected obfuscated JavaScript into compromised websites to randomly redirect visitors to attacker-controlled domains mimicking Cloudflare verification pages. The fake pages fed victims into a malicious Microsoft device code authentication flow to get them to authorize attacker-controlled devices for access to Microsoft 365 accounts; Amazon, Cloudflare, and Microsoft collaborated to isolate and take down the infrastructure used.