Loading threat actor…
TA2723 is a financially motivated cybercriminal threat actor associated with high-volume credential phishing and, since at least October 2025, OAuth device code phishing targeting Microsoft 365 accounts. The actor is known for spoofing widely trusted business services and brands, including Microsoft OneDrive, LinkedIn, and DocuSign, and for using document-sharing and salary- or benefits-themed social-engineering lures to drive victims into account-compromise workflows. TA2723 has been observed abusing the OAuth 2.0 device authorization flow to induce victims to enter attacker-provided device codes on legitimate Microsoft verification pages. This technique enables account takeover without relying on fake Microsoft login pages and can yield access and refresh tokens that support persistent access to Microsoft 365 resources. Follow-on activity associated with successful device code phishing includes access to victim email and cloud data, as well as opportunities for lateral movement and persistence. Reporting links TA2723’s device code phishing activity to tooling such as SquarePhish2 and Graphish in different campaign waves. These tools automate and scale phishing operations, including QR-code or link-driven workflows and, in the case of Graphish, Azure application registration abuse and adversary-in-the-middle capabilities. TA2723’s tradecraft reflects broader criminal adoption of passwordless phishing techniques that exploit legitimate authentication mechanisms for stealth and effectiveness.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a Russian threat group that has used device code phishing attacks to hijack Microsoft accounts.
TA2723 is a financially motivated threat group known for high-volume credential phishing campaigns, now leveraging OAuth device code phishing to compromise Microsoft 365 accounts.
TA2723 is a financially motivated threat actor conducting high-volume credential phishing campaigns using device code phishing techniques, targeting users with salary and benefits-themed lures to gain access to Microsoft 365 accounts.
TA2723 is a financially motivated cybercriminal group known for high-volume credential phishing, recently adopting OAuth device code phishing techniques to compromise Microsoft 365 accounts.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.