[Stanley]

Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentic

Amazon on Friday said it flagged and disrupted what it described as an opportunistic watering hole campaign orchestrated by the Russia-linked APT29 actors as part of their intelligence gathering efforts.
The campaign used "compromised websites to redirect visitors to malicious infrastructure designed to trick users into authorizing attacker-controlled devices through Microsoft's device code

https://thehackernews.com/2025/08/amazon...-hole.html

[Rsynced]

Sounds like fun! 😆✌

[W1NK1LL3RX]

APT29 never quits, now they’re abusing Microsoft’s device code auth. Good catch by Amazon shutting that down before it spread further.

[plops]

Good ol russia. Amazon gives ope sometimes.

[sharn]

Fake Cloudflare verification is sneaky.
Users click because it feels routine.

[The Pact]

Just like predators in the wild wait near watering holes to ambush prey, attackers lie in wait on trusted websites, hoping their targets will come to them.
Attackers identify websites popular with their intended victims like they might target government workers or journalists or even diplomats! Their goal might be to steal login credentials, install spyware, or gain access to systems.
Victims often trust the compromised site. That's what we all have to watch out for. :-(