The researchers also observed multiple Russian spear-phishing campaigns in early February 2025, which targeted users with fake Microsoft invitations purporting to be from the US Department of State.

Similarly to the first campaign, the emails aimed to convince the user to accept an invitation for a conference call, with the links directing them to the Microsoft Device Code authentication page.

However, unlike the previous attack, the email was sent out of the blue without any build up or precursor. This means the attempt was less likely to work as the target would have needed to click on the link and input the code within 15 minutes of receiving the email.

Several other similar attacks have been observed by Volexity using fake invitations to various video platforms and chatrooms. These included the impersonation of a member of the European Parliament who is on the Committee on Foreign Affairs requesting a Microsoft Teams meeting to discuss Donald Trump and his impact on relations between the US and the European Union.

Many of these started a conversation prior to sending the link to the Microsoft Device Code authentication page to increase the chances of the target entering the generated code quickly.

In one case, a different device code phishing technique was used. Rather than the email link taking the target to the Microsoft Device Code authentication page, they were instead taken to a website controlled by UTA0307. This page was designed to appear as an official Microsoft interstitial page before the user can join a Microsoft Teams meeting, and was set up to automatically generate a new Microsoft Device Code each time it was visited.

The message on the landing page claimed that the victim needed to pass a security check by copying a code and entering it on a subsequent page. When this supplied code is inputted, it provides the attackers with access to the victim’s M365 account.