Amazon disrupts APT29 watering hole harvesting MS credentials

Amazon said its threat intelligence team disrupted a watering hole campaign by the Russian-linked espionage group APT29 that sought to trick visitors into authorizing attacker-controlled devices through Microsoft authentication, the company announced on August 29. The campaign used compromised legitimate websites to redirect a subset of visitors to attacker domains that mimicked Cloudflare and attempted to harvest Microsoft credentials, Amazon Chief Information Security Officer CJ Moses wrote.

According to Amazon, threat actors injected obfuscated JavaScript into several legitimate sites to redirect roughly 10 percent of visitors to actor-controlled domains. The malicious domains included findcloudflare.com and later cloudflare.redirectpartners.com, which were engineered to look like Cloudflare verification pages and steer victims into Microsofts device code authentication flow. Amazon described the operation as opportunistic, designed to cast a wider net for intelligence collection rather than focus narrowly on a small set of high-value targets.

Technical analysis by Amazon found multiple evasion techniques. The malicious code used randomized redirections, base64 encoding and...