A new wave of targeted phishing attacks exploiting Microsoft 365’s OAuth workflows has been uncovered by cybersecurity experts. These campaigns, observed by Volexity since March 2025, involve Russian-linked threat actors impersonating European diplomats and Ukrainian officials. The emails try to lure human rights workers and NGO staff into handing over authentication codes that grant access to their Microsoft accounts. Sophisticated Social Engineering Behind the Attacks The threat actors, tracked by Volexity as UTA0352 and UTA0355, are using highly personalized tactics to manipulate targets. Victims receive outreach messages via Signal or WhatsApp, typically appearing to come from European officials proposing meetings on matters related to Ukraine. These conversations eventually lead to…