Storm-2372 (Feb’25) has been virtually ignored, even though Russian threat actors demonstrated in-the-wild exploits using OAuth Device Code Phishing (Syynimaa, Oct’20) and PRT/device registration abuse (Moller, Oct’23) that fundamentally puts all Entra customers at risk via its abuse of OAuth, the device registration service, SSO and compromise of the Primary Refresh Token. Talk will walk through the findings and discuss the detection, prevention, and what can be done effectively against the attack.

View the slide deck here.