A New Cyber Threat Targeting Microsoft 365 Users

March 4, 2025

Recent reports from cybersecurity researchers at Volexity have uncovered a highly targeted spear-phishing campaign aimed at Microsoft 365 accounts. Russian threat actors, including the SVR’s Cozy Bear, are actively engaging in attacks designed to compromise business and government accounts worldwide. Understanding their tactics and learning how to defend against them is crucial for law firms and businesses of all types that rely on Microsoft 365 for their daily operations.

How These Attacks Work

This latest campaign employs a technique called Device Code Authentication, which exploits Microsoft’s sign-in system designed for input-limited devices such as smart TVs and printers. Cybercriminals use social engineering tactics to trick users into entering a code that ultimately grants attackers access to their Microsoft 365 accounts.

Here’s how it happens:

Attackers impersonate trusted entities such as government agencies, research institutions, or corporate employees.
They initiate conversations via email or messaging apps (e.g., Signal, WhatsApp, or Teams) to establish credibility and gain trust.
Victims receive a link that appears to be a legitimate Microsoft Teams meeting invite or another secure chat request.
The link leads to a Microsoft Device Code authentication page, prompting the user to enter a unique code.
Once the victim enters the code and logs in, the attacker is granted long-term access to the Microsoft 365 account, bypassing traditional security measures like Multi-Factor Authentication (MFA).

These types of real-time phishing attacks are proving more effective than previous phishing attempts, as they take advantage of an authentication method that users trust.

Why This Matters for ANY Business

While these attacks have been targeting government agencies and large organizations, small businesses are not immune. Many companies rely on Microsoft 365 for email, document storage, and communication—making them prime targets for cybercriminals looking to steal sensitive data or gain a foothold for future attacks.

Because MFA alone is not foolproof, businesses must implement additional security layers to reduce their exposure to these threats.

How to Protect Yourself from Spear-Phishing Attacks

To safeguard your Microsoft 365 accounts from these tricky and advanced attacks, consider taking the following security measures:

Verify Unexpected Requests: If you receive an unexpected login request, meeting invite, or authentication code prompt, verify it directly with the sender using a known contact method. Also, be especially cautious of messages requesting you to switch from one chat app to another.
Educate Your Employees: Train staff on the latest phishing tactics, including social engineering techniques used in real-time attacks. Additionally, encourage employees to report suspicious messages instead of engaging with unknown contacts.
Implement Stronger Authentication: While MFA is crucial, opt for phishing-resistant methods like hardware security keys or app-based verification instead of SMS or email codes, which are more vulnerable to interception. However, no authentication method is completely invulnerable – if a network is already compromised, even strong authentication measures could be defeated.
Monitor Login Activity: Enable logging, review sign-in activity, and set up alerts for login attempts from unexpected locations or devices.
Limit Access to Sensitive Data: Implement role-based access control to ensure that only necessary personnel can access critical systems. It’s also a good idea to regularly audit permissions and revoke access for inactive users.

Need Help Securing Your Microsoft 365 Environment?

Staying ahead of cyber threats requires continuous vigilance and proactive security measures. If your business relies on Microsoft 365, we can help you harden your security posture and train your employees to recognize sophisticated phishing attacks before they succeed. There are also enterprise-grade solutions that take a comprehensive and multi-faceted approach to securing your infrastructure – we can let you know what those solutions are and if they’re a good fit for your business!