Researchers at Microsoft have discovered a group that has been dubbed Storm-2372 using “device code phishing” that tricks users into logging into productivity apps that allows the hackers to capture information from the log in (tokens) in order to access compromised accounts. The researchers believe this group could be aligned with Russia’s interests and tradecraft:
Today we’re sharing that Microsoft discovered cyberattacks being launched by a group we call Storm-2372, who we assess with medium confidence aligns with Russia’s interests and tradecraft. The attacks appear to have been ongoing since August 2024 and have targeted governments, NGOs, and a wide range of industries in multiple regions. The attacks use a specific phishing technique called “device code phishing” that tricks users to log into productivity apps while Storm-2372 actors capture the information from the log in (tokens) that they can use to then access compromised accounts. These tokens are part of an industry standard and, while these phishing lures used Microsoft and other apps to trick users, they do not reflect an attack unique to Microsoft nor have we found any vulnerabilities in our code base enabling this activity.
Roger Grimes, data-driven defense evangelist at KnowBe4, commented:
“The best piece of advice I can give anyone to fight phishing of any type is this: If you receive an unexpected message, no matter where received (e.g., in-person, email, browser, social media, SMS, etc.) and it is asking you to do something you’ve never done before, research it outside of the information given in the message before performing. If more people followed this advice, there would be far less successful phishing. This applies to device code phishing.”
“Device code phishing attacks aren’t new, but the use by a possible nation-state aggressor does significantly increase the risk to those targeted victims. And let’s remember that today’s most likely targeted victim is a regular person or regular company. Nation-states no longer focus on traditional nation-state targets like government or military agencies or contractors.”
“One of the most concerning aspects of this attack is the ability for the attacker to get the victim’s primary refresh token, which is a Microsoft Azure-only specialized authentication access token, which allows the attacker to access any of the involved apps the victim is using. When a traditional browser access control token is stolen, it gives the attacker access to only the involved site/service/app that the token was generated by. But the primary refresh token can be used to access any app the victim has access too. Its power is exponential.”
These are the sorts of attacks that can be mitigated if not stopped if there is more user awareness and training. Therefore I challenge organizations to go out and invest in user training as well as performing simulated attacks to that users will be less of a risk to your organization.
XCSSET macOS Malware Reappears With New Attack Strategies
Posted in Commentary with tags Microsoft on February 18, 2025 by itnerdMicrosoft has warned that a new variant of XCSSET malware is actively targeting macOS users. “The latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies,”
Roger Grimes, Data-Driven Defense Evangelist at KnowBe4,commented:
“Downloading, running, or re-using any code from any repository is taking a big risk. If you download and reuse code that you yourself or someone you greatly trust did not write, you have to inspect it. This is a lesson the world has known about the threat of reusing other people’s code since the late 1970’s. In 1984, one of the co-creators of Unix, Ken Thompson, wrote a seminal paper on the trustworthiness of code titled Reflections on Trust. He summarized it by stating, “You can’t trust code that you did not totally create yourself.” He footnotes a 1974 paper on software security paper entitled Multics Security Evaluation: Vulnerability Analysis that says the same. Unfortunately, almost none of today’s programmers are taught basic ‘secure code’ skills, and hence each generation of programmers seems to have to learn the same mistakes of the past. We need all of today’s programming curriculums teaching secure coding, including the need to be wary of and inspect others’ code, and we need employers who hire programmers requesting that those programmers come with secure coding skills.”
“It’s a little ironic to see Microsoft pointing out and defending against Mac vulnerabilities and threats, especially before Apple does. But that’s testament to today’s interconnected world and the shift that Microsoft has made in better protecting the entire ecosystem.”
This is a reminder that Mac users are not immune to threats. They need to practise good computing habits such as these. Because threats like this one are starting to become more and more common on the Mac platform. Which means that you need to be on guard at all times.
Leave a comment »