{"id":18660,"date":"2025-02-21T10:00:34","date_gmt":"2025-02-21T09:00:34","guid":{"rendered":"https:\/\/cyberinsights.iainfraser.net\/?p=18660"},"modified":"2026-06-10T12:14:57","modified_gmt":"2026-06-10T10:14:57","slug":"phishing-variant-bypassing-mfa","status":"publish","type":"post","link":"https:\/\/smecyberinsights.co.uk\/index.php\/2025\/02\/21\/phishing-variant-bypassing-mfa\/","title":{"rendered":"THREAT INTEL: STATE ACTORS – Russian hackers are Phishing their way past MFA"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"Partners1_NordVPN\"<\/figure><\/div>
\"Partners3_R3\"<\/figure><\/div>
\"Partners2_Zoho\"<\/figure><\/div>
\"Partners4_Plesk\"<\/figure><\/div>
\"Red_Button_Slider\"<\/figure><\/div>
\"ogo2\"<\/figure><\/div>
\"Detection.<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"standard-quality-control-collage-concept\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Freepik<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Helping Keep Small Business CYBERSafe!
\n<\/strong>Gibraltar: Friday 21 February 2025 at 10:00 CET<\/p>\n

THREAT INTEL: STATE ACTORS – Russian hackers are Phishing their way past MFA rendering the authentication protocol pretty much useless.<\/strong>
\nBy: Iain Fraser<\/a> – Cybersecurity Journalist<\/a>
\nCYBERInsights<\/a>\u00a0\u2013\u00a0The UK Small Business Cybersecurity Network<\/a>
\nPublished in Association with:<\/em> R3DataRecovery.com
<\/a>Google Indexed on 210225 at 11:20 CET<\/a>
\n#CyberInsights #CyberSecurity #CyberAwareness #CyberSafe #SME #SmallBusiness #ThreatIntel<\/em><\/span><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

A State sponsored, Russian based Hacking group with links direct to Vladimir Putin are reported to have deployed a new Phishing<\/strong><\/a> variant to enable a seamless bypass of your MFA<\/strong><\/a> (2FA) protocols and credentials making a mockery of the “authentication”<\/em> .<\/p>\n

The threat was first revealed by Microsoft<\/strong> who have warned about a Russian Threat group known as Storm-2372. Microsoft<\/strong> has reported that the Hacker outfit has modified its tactics using a specific \u2018device code phishing\u2019 technique to bypass multi-factor authentication (MFA<\/strong><\/a>) and steal access tokens and have been active doing exactly that since August last year.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"standard-quality-control-collage-concept\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Freepik<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

The technique, device code Phishing<\/strong><\/a>, takes advantage of an industry standard authentication practice for devices that cannot perform authentication using a web flow and must use another device to sign in.
\nIt has been observed targeting governments, NGOs, as well as organizations in the IT, defence, telecoms, health, energy, and education sector across multiple regions, Microsoft<\/strong> added.<\/p>\n

How it works.<\/strong><\/p>\n

Attackers first initiate the authentication flow by requesting a device code from the targeted service, and then send the code to the victim under the guise of an invite to a Teams meeting or a registration code, for example. The target will go through their usual authentication process entering their username, password, and MFA<\/strong><\/a> credentials into the legitimate service portal, but once the service generates access the threat actor can recover the access token. SIMPLES! Cybersecurity luminaries have warned that this tactic could become increasingly common amongst threat actors as it can get around additional security layers that prevent more rudimentary Phishing<\/strong><\/a> attacks.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tPROTECT YOUR SME NOW! \/...<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"Image\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: IfOnlyCommunications<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

CYBER Insights \u2013 Helping Keep Small Business CYBERSafe!\u00a0<\/strong><\/p>\n

Launched in 2020 by\u00a0Cybersecurity Journalist<\/a>\u00a0Iain Fraser<\/strong>\u00a0and his team at\u00a0IfOnly…<\/strong><\/a> CYBERInsights<\/strong><\/a> was developed to be the go-to platform providing definitive, reliable & actionable Cybersecurity News, Intel,\u00a0 Awareness & Training specifically written and curated for Small Business<\/strong><\/a> & Enterprise Owners, Partners and Directors throughout the UK. #CyberInsights #CyberSecurity #CyberAttack #CyberAwareness\u00a0 #Compliance #DDoS #Fraud #Ransomware #ScamAlert #SME #SmallBusiness #SmallBusinessOwner #ThreatIntel <\/span><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"Been\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Lost your data? Don’t panic. R3 can help! Real data recovery services from a real UK lab!<\/strong>
\nData loss can happen at any time and can happen in the most unexpected ways. As long as your device hasn’t been stolen R3 can recover your data from the most unlikely disasters. From their wholly secure state of the art Recovery Lab they can deploy the very best data recovery service as quickly as possible. Their technicians are among the best in the sector and can recover lost data from hard drives, RAID arrays, Flash Memory devices like USB Memory Sticks, SD Cards and SSD hard drives. Their “clean room” lab facilities are beyond compare, reaching a class leading ISO 3 standard. If you have been the victim of a Ransomware Attack or Lost Valuable Data R3 data recovery provide cost-effective data recovery solution – Fast! #CyberInsights #CyberSecurity #CyberAttack #CyberAwareness #CyberSecurityAwareness #SME #SmallBusiness #SmallBusinessOwner #Ransomware #RansomwareRecovery #DataLoss #DataRecovery #R3<\/em><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tLearn More \/...<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"_CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Report<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Image Credit: Freepik Image Credit: Freepik PROTECT YOUR SME NOW! \/… Image Credit: IfOnlyCommunications Learn…<\/p>\n","protected":false},"author":1,"featured_media":18599,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"yes","footnotes":""},"categories":[604,440],"tags":[439],"ppma_author":[505],"class_list":["post-18660","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scam","category-cyberthreat-intel","tag-cyberthreat-intel"],"featured_image_urls":{"full":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3.jpg",697,465,false],"thumbnail":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3-150x150.jpg",150,150,true],"medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3-300x200.jpg",300,200,true],"medium_large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3.jpg",640,427,false],"large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3.jpg",640,427,false],"1536x1536":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3.jpg",697,465,false],"2048x2048":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3.jpg",697,465,false],"covernews-featured":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3.jpg",697,465,false],"covernews-medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/02\/standard-quality-control-collage-concept-3-540x340.jpg",540,340,true]},"author_info":{"display_name":"Cybersecurity Journalist Iain Fraser","author_link":false},"category_info":"SCAM<\/a> SME CYBER\/THREAT INTEL<\/a>","tag_info":"SME CYBER\/THREAT INTEL","comment_count":"0","authors":[{"term_id":505,"user_id":1,"is_guest":0,"slug":"admin_yjdstq4n","display_name":"Cybersecurity Journalist Iain Fraser","avatar_url":{"url":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png","url2x":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png"},"author_category":"1","user_url":"http:\/\/smecyberinsights.co.uk","last_name":"Cybersecurity Journalist","first_name":"Iain Fraser","job_title":"","description":""}],"_links":{"self":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/18660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=18660"}],"version-history":[{"count":15,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/18660\/revisions"}],"predecessor-version":[{"id":28779,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/18660\/revisions\/28779"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media\/18599"}],"wp:attachment":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=18660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=18660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=18660"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/ppma_author?post=18660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}