Amazon Just Caught Russian Hackers Targeting Microsoft 365 (Here's What You Need to Know)

Remember when breaking into someone's account meant guessing their password? Those days are long gone. Russian state hackers are now using some seriously clever tricks to get into Microsoft 365 accounts, and it's pretty wild how they're doing it. Thankfully, Amazon's security team just caught them in the act.

Who Are These Hackers?

We're talking about APT29 (also called Midnight Blizzard), and these aren't your average cybercriminals. They're the elite hackers working for Russian intelligence, and they've been causing headaches for years. Their latest trick? Setting up fake Microsoft login pages that look exactly like the real thing.

Here's How The Attack Works (It's Pretty Sneaky)

Instead of sending obvious phishing emails, these hackers compromised legitimate websites and turned them into what we call "watering holes." When you visit one of these infected sites, you get quietly redirected to a fake Cloudflare login page, which then sends you to a convincing Microsoft 365 login screen.

What makes this attack extra dangerous is how it abuses Microsoft's device code authentication - you know, that thing where you go to microsoft.com/devicelogin and enter a code? The hackers automated this process, making it really hard to spot the fake from the real thing.

Why This Is a Big Deal

This isn't just another phishing scam. These hackers are specifically going after high-value Microsoft 365 accounts, often belonging to government officials, executives, and security researchers. And they're not just after passwords - they want full access to email, documents, and corporate data.

How to Protect Yourself

First things first: You need serious protection for your Microsoft account. I personally use YubiKey as a hardware security key - it's basically impossible for hackers to trick you when you're using one of these. Even if they get your password, they can't get in without the physical key.

Here are the essential steps everyone should take:

1. Enable Multi-Factor Authentication (MFA) immediately - no exceptions

2. Use a password manager (I trust NordPass for my family)

3. Verify any Microsoft device code requests carefully

4. Never enter Microsoft credentials on a page you didn't navigate to directly

5. Keep your Microsoft 365 security settings up to date

What Amazon, Microsoft, and Cloudflare Are Doing About It

The good news is that Amazon's security team tracked down and exposed the hackers' infrastructure. They're working with Microsoft and Cloudflare to shut down the fake login pages and protect users. Microsoft has also updated their security to better detect these attacks.

The Bottom Line

This isn't just another "change your password" situation. These attacks show how sophisticated state-sponsored hackers have become. But here's the thing - most of their success still relies on us making basic security mistakes.

If you manage Microsoft 365 for your organization, now's the time to audit your security settings. For everyone else, please take the steps above seriously. Trust me, dealing with a compromised account is way more painful than setting up proper security in the first place.

Quick heads up:Some links in this article are affiliate links. If you buy something through them, we might earn a small commission (doesn't cost you extra). We only recommend stuff we'd actually use ourselves or set up for our own families. No BS recommendations here.