+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic (/showthread.php?tid=6307798)
Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic - Stanley - Sep 9, 2025
Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic
Amazon on Friday said it flagged and disrupted what it described as an opportunistic watering hole campaign orchestrated by the Russia-linked APT29 actors as part of their intelligence gathering efforts.
The campaign used "compromised websites to redirect visitors to malicious infrastructure designed to trick users into authorizing attacker-controlled devices through Microsoft's device code
https://thehackernews.com/2025/08/amazon-disrupts-apt29-watering-hole.html
RE: Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic - Rsynced - Sep 9, 2025
Sounds like fun! 😆✌
RE: Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic - W1NK1LL3RX - Sep 9, 2025
APT29 never quits, now they’re abusing Microsoft’s device code auth. Good catch by Amazon shutting that down before it spread further.
RE: Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic - plops - Sep 9, 2025
Good ol russia. Amazon gives ope sometimes.
RE: Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic - sharn - Sep 14, 2025
Fake Cloudflare verification is sneaky.
Users click because it feels routine.
RE: Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic - The Pact - Sep 28, 2025
Just like predators in the wild wait near watering holes to ambush prey, attackers lie in wait on trusted websites, hoping their targets will come to them.
Attackers identify websites popular with their intended victims like they might target government workers or journalists or even diplomats! Their goal might be to steal login credentials, install spyware, or gain access to systems.
Victims often trust the compromised site. That's what we all have to watch out for. :-(