hxxps://login.microsoftonline[.]com/common/oauth2/authorize?url=https://teams.microsoft.com/URL
Reported by 1 independent source · first reported by Volexity · last reported
Last reported 18 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows“hxxps://login.microsoftonline[.]com/common/oauth2/authorize?url=https://teams.microsoft.com/[redacted]&client_id=29d9ed98-a469-4536-ade2-f981bc1d605e&resource=01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9&response_type=code&redirect_uri=https%3A%2F%2Flogin.microsoftonline.com%2FWebApp%2FClo…”
Indicators reported together
named in the same reports- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=https://mae.gov.ro/in 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?redirect=https://zoom.us/j/in 1 report
- vscode-redirect.azurewebsites[.]netin 1 report
- usesinsiders.vscode[.]devin 1 report
- hxxp://127.0.0[.]1:9217/callback?code=1.ARsAIGLD9ki0FE63WmhS-KbgFENkvK5tmXin 1 report
- address[.]herein 1 report
- hxxps://login.microsoftonline[.]com/WebApp/CloudDomainJoin/8?code=in 1 report
- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=in 1 report
- hxxps://insiders.vscode[.]dev/redirectin 1 report
- insiders.vscode[.]devin 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?redirect=in 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.