THREAT INTEL: STATE ACTORS – Russian hackers are Phishing their way past MFA

The technique, device code Phishing, takes advantage of an industry standard authentication practice for devices that cannot perform authentication using a web flow and must use another device to sign in.
It has been observed targeting governments, NGOs, as well as organizations in the IT, defence, telecoms, health, energy, and education sector across multiple regions, Microsoft added.

How it works.

Attackers first initiate the authentication flow by requesting a device code from the targeted service, and then send the code to the victim under the guise of an invite to a Teams meeting or a registration code, for example. The target will go through their usual authentication process entering their username, password, and MFA credentials into the legitimate service portal, but once the service generates access the threat actor can recover the access token. SIMPLES! Cybersecurity luminaries have warned that this tactic could become increasingly common amongst threat actors as it can get around additional security layers that prevent more rudimentary Phishing attacks.