Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

In early 2025, Volexity published two blog posts detailing a new trend among Russian threat actors targeting organizations through the abuse of Microsoft 365 OAuth and Device Code authentication workflows to gain access to Microsoft user accounts. Despite detailing these activities publicly, Volexity continues to see similar techniques being leveraged by Russian threat actors to heavily target both Microsoft and Google environments. While the techniques are similar, what…

Diamond Model