Russia-Linked Hackers carried out a phishing attack using Microsoft 365 Device Code
Cybersecurity researchers have discovered a hacking group linked to Russia that is using advanced phishing techniques to hack Microsoft 365 accounts. This campaign has been named UNK_AcademicFlare by Proofpoint. This campaign was detected in September 2025, and Proofpoint has named it UNK_AcademicFlare.
Hackers are using hacked email accounts of government and military organizations to target the government, think tank, higher education, and transportation sectors in the US and Europe. This email appears to be genuine and appears to come from a trusted source.
How do attackers carry out phishing attacks?
- Building Trust
Attackers do not do direct phishing; they first start a normal professional conversation through email and talk about the victim’s area of expertise, and try to know their details. Because the email seems completely harmless (benign), no one even realizes that there is a hacker in front of them or a trusted person.
- Holding fake meetings and sharing fake documents
Once trust is built, they propose a fake meeting or interview, saying they are sharing some questions/topics for review. They then share an attached document, which is actually a link. This link is a Cloudflare Worker URL, which is a spoofed version of OneDrive. This fake OneDrive account appears to be from the same organization whose email was hacked, which makes it seem even more genuine.
- Device Code Phishing
When the user opens the fake OneDrive link, they see a Microsoft device code login flow. The victim thinks this is a normal Microsoft login. As soon as the victim enters the device code and approves the login, the attacker gains access to their Microsoft 365 account, and the game is over.
UNK_AcademicFlare sends an initial email that starts with a seemingly harmless conversation. The purpose of this initial email is solely to build trust. At this stage, there are no malicious links or attachments, so the victim doesn’t feel any danger. When the target responds positively, the attacker moves to the next phase.
After the conversation progresses a bit, the attacker says, “I am sharing some topics/questions/documents for review.” This is accompanied by a link that appears to be completely safe. The link looks like OneDrive or gives the impression of being on a government domain, but the link is actually hosted on a Cloudflare worker domain, not the real Zambian government OneDrive, just a fake page.
This image is the final and most dangerous step of UNK_AcademicFlare’s phishing attack. At this stage, the victim has already trusted the trusted email and opened a link that looks like OneDrive, and when the victim opens the link, a landing page opens. On this page, a unique device code appears, and the user is asked to copy the code and click on the “Next” button. As soon as the user clicks on “Next, the user is redirected to the actual Microsoft website, and as soon as he enters the device code, the login is complete.
As the user enters the device code, the attacker gets access to the Microsoft 365 account. Emails, OneDrive, calendar, contacts, everything gets compromised. The attack is successful even after having MFA. The user thinks: “I am just accessing the document. Actually, the attacker has the login access.
This attack does not rely on a fake login page; it misuses genuine Microsoft authentication. That’s why it’s silent, looks reliable, and is so dangerous.
Effective security steps to avoid device code phishing.
Block device code flow: Device Code Flow is a Microsoft login method that allows users to copy a code and log in to Microsoft’s official page. The problem is that attackers are misusing the process.
If Poora Block Is Not Possible, use the Allow-List: In some organizations, device code login is required. In such cases, use the allow-list approach with conditional access, allowing only specific cases: approved users, specific operating systems, trusted IP ranges, and office locations (named locations). Block access for everyone except trusted users.
Only allow logins from compliant or company-managed devices: If the organization uses company laptops/mobile devices, this provides much stronger security. In this case, implement a conditional access policy: Allow login only if the device is either registered with the company or Intune-compliant. This significantly reduces the risk of device code phishing.
Educate users about device code phishing: Traditional user training for device code phishing says, “Check the URL.” But in device code phishing, the URL is completely correct. Therefore, the training needs to be updated. Users should be taught: If an email/message contains a device code and you are asked to “Log In, never enter the code without IT confirmation. Verify unsolicited document sharing or meeting invitations. The problem is not with the fake URL, but with the fake instructions. Let users know about it.
Why Choose Ransom Security?
Nowadays, hackers do not use fake login pages. They take advantage of the original Microsoft login process (device code flow). Therefore, standard security tools or MFA cannot easily detect these attacks. Ransom security detects attacks at the email level, before the user clicks the link, enters the device code, or approves the account login. The email is blocked/quarantined before any of these actions take place.
If the inbox is secure, there will be no phishing, no compromised logins, and identities will remain protected. The inbox is the entry point for attacks – and this is where Ransom Security protects.
Secure your inbox before it becomes an entry point. Connect with Ransom Security experts today and stop phishing attacks before they harm your users, devices, or business.
Frequently Asked Questions
In traditional phishing, attackers create fake login pages, send fake URLs, and try to steal passwords. But in device code phishing, there is no fake website; The user is redirected to the real Microsoft login page, and the user enters the device code themselves, after which the login credentials are stolen.
Yes, but without breaking the MFA. Device code phishing doesn’t technically hack MFA, but rather tricks the user into mistakenly approving an MFA request. Normally, the user logs in, an MFA prompt appears, the user verifies, and access is granted. It is safe. In this attack, the user receives an email containing a device code. The user goes to Microsoft’s original login page, and the user approves the MFA request, without knowing that the attacker sent the request. The attacker gets access to the account. MFA isn’t broken; the user unknowingly approved it.
Device code phishing attacks bypass traditional security tools because they misuse real Microsoft login workflows. Therefore, MFA alone is not enough to stop them. Ransom Security prevents device code phishing attacks at the email layer by detecting suspicious authentication lures, blocking compromised sender campaigns, and preventing users from reaching the point where MFA can be abused.
If a user receives a device code login email, they should not enter the code, avoid clicking any links, report the email to security, verify the sender through another channel, and immediately contact their security team if they interacted with it.
Email is still the number one entry point for cyberattacks – phishing, ransomware, device code phishing, and account takeovers all start in the inbox. Ransom Security is different because it not only filters emails, but also stops attacks before they start. It stops modern phishing attacks, protects user identities, blocks zero-click threats, and provides expert-led protection before damage is done.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!