ta2723
TA2723 is a financially motivated cybercriminal threat actor associated with high-volume credential phishing. Proofpoint describes TA2723 as previously known for campaigns spoofing Microsoft OneDrive, LinkedIn, and DocuSign. Beginning in October 2025, Proofpoint observed TA2723 using OAuth 2.0 device code phishing against Microsoft 365 accounts, including campaigns using salary- and benefits-themed lures, shared-document themes, and fake landing pages that directed victims to the legitimate Microsoft device authorization flow. Reported lures included salary-amended documents and salary bonus or employer benefit reports. Proofpoint assessed that early phases of these campaigns likely used the SquarePhish2 tooling, with later waves potentially shifting to the Graphish phishing kit. The activity is described as enabling Microsoft 365 account takeover and access via attacker-obtained tokens. TA2723 is also mentioned alongside other threat clusters observed using device code phishing. No additional aliases or sub-groups beyond TA2723 are directly supported in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a Russian threat group that has used device code phishing attacks to hijack Microsoft accounts.
TA2723 is a financially motivated threat group known for high-volume credential phishing campaigns, now leveraging OAuth device code phishing to compromise Microsoft 365 accounts.
TA2723 is a financially motivated threat actor conducting high-volume credential phishing campaigns using device code phishing techniques, targeting users with salary and benefits-themed lures to gain access to Microsoft 365 accounts.
TA2723 is a financially motivated cybercriminal group known for high-volume credential phishing, recently adopting OAuth device code phishing techniques to compromise Microsoft 365 accounts.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.