Loading malware…
AUTHENTIC ANTICS is a Windows malware family publicly attributed by the UK NCSC to APT28 (GRU Unit 26165/Fancy Bear/Sofacy). It is designed to obtain persistent access to Microsoft cloud accounts by blending into legitimate Outlook and Microsoft authentication activity. The malware runs inside the Microsoft Outlook process and periodically displays malicious Microsoft login prompts to steal Microsoft Office credentials, OAuth 2.0 authorization codes, and tokens, enabling unauthorized access to victim email accounts and likely related Microsoft 365 services such as Exchange Online, SharePoint, and OneDrive depending on tenant configuration.
Observed in 2023, AUTHENTIC ANTICS uses a dropper named Microsoft.Identity64.dll to decrypt and load an in-memory .NET stealer payload named Microsoft.Identity.Client.dll. Persistence is achieved via COM hijacking by replacing the InprocServer32 path for CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27}, which normally points to npmproxy.dll used by Outlook at startup. The malware limits execution using the registry key HKCU\Software\Microsoft\Office\16.0\Outlook\Logging\Counter and stores the most recently stolen refresh token in HKCU\Software\Microsoft\Office\16.0\Outlook\Logging\Locale.
The malware includes multiple defense evasion measures. It uses heavy string obfuscation, environmental keying tied to the victim machine, and verifies it is executing inside outlook.exe by checking process and window characteristics. It detects and removes suspected hooks from ntdll.dll registry functions by mapping a clean copy of ntdll.dll and restoring bytes if needed, and it hooks IEConfiguration_GetBool in iertutil.dll. Its embedded stealer payload is AES-256 encrypted with a machine-specific key derived from the MachineGuid in HKLM\Software\Microsoft\Cryptography and the C: drive volume serial number, or the computer name if MachineGuid is absent.
For credential theft, AUTHENTIC ANTICS enumerates Office identity information under HKCU\Software\Microsoft\Office\16.0\Common\Identity\Identities, selects the most recently used ADAL-backed account, and extracts EmailAddress and PreferredUsername. It then creates a controlled browser window inside Outlook and directs it to login.microsoftonline.com/common/oauth2/authorize using the Microsoft Office client_id d3590ed6-52b3-4102-aeff-aad2292ab01c. It intercepts the browser navigation flow to capture the authorization code, username, and password, and redeems authorization codes or refresh tokens against https://login.microsoftonline.com/common/oauth2/token.
AUTHENTIC ANTICS does not rely on traditional command-and-control infrastructure. It communicates only with legitimate services, including Microsoft OAuth endpoints, Outlook’s web API, and http://www.gstatic.com/generate_204 for connectivity checks. Exfiltration is performed by sending compressed and RSA-encrypted stolen credential and token data from the victim’s own Outlook account to an actor-controlled email address via https://outlook.office.com/api/v2.0/me/sendMail, with SaveToSentItems set to false so the message does not appear in the victim’s Sent Items.
High-confidence indicators and artifacts mentioned in the reporting include the filenames Microsoft.Identity64.dll and Microsoft.Identity.Client.dll; the COM hijack CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27}; suspicious registry values under HKCU\Software\Microsoft\Office\16.0\Outlook\Logging\Counter and ...\Locale; use of login.microsoftonline.com/common/oauth2/authorize and /common/oauth2/token; use of the Outlook sendMail API endpoint; and the Microsoft Office OAuth client ID d3590ed6-52b3-4102-aeff-aad2292ab01c. The NCSC report also states that samples were victim-specific and therefore hashes were not published.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
the National Cyber Security Centre — a part of GCHQ — has also revealed for the first time that the cyber threat group APT 28 has been responsible for deploying a sophisticated malware dubbed AUTHENTIC ANTICS as part of its operations.
Along with the sanctions, the UK also attributed a new malware family to APT28. Dubbed Authentic Antics (PDF), the malware was “specifically designed to enable persistent endpoint access to Microsoft cloud accounts by blending in with legitimate activity”.
Along with the sanctions, the UK also attributed a new malware family to APT28. Dubbed Authentic Antics (PDF), the malware was “specifically designed to enable persistent endpoint access to Microsoft cloud accounts by blending in with legitimate activity”.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
AUTHENTIC ANTICS is persisted via COM Hijacking. The path to the loader, Microsoft.Identity64.dll is placed in the registry key HKLM\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 this normally contains the path to npmproxy.dll which is called by Outlook on startup.
AUTHENTIC ANTICS is persisted via COM Hijacking. The path to the loader, Microsoft.Identity64.dll is placed in the registry key HKLM\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 this normally contains the path to npmproxy.dll which is called by Outlook on startup.
AUTHENTIC ANTICS stealer payload is embedded within the loader and is encrypted with AES-256. The key used to decrypt the payload is derived from machine-specific data, meaning it is keyed to the victim machine and will not decrypt unless it is running on the intended target device.
To steal tokens, AUTHENTIC ANTICS will generate a pop-up browser window it controls from within the Outlook process and direct it to Microsoft’s Authorization Server, login.microsoftonline.com specifically the /authorize endpoint...
To be able to intercept the data sent between the created pop-up browser login prompt and Microsoft’s servers, AUTHENTIC ANTICS sets up a “Navigating” event handler to intercept the web request and extract the authorisation code... As well as the authorisation code, the username and password are also extracted from the intercepted request for exfiltration.
To be able to intercept the data sent between the created pop-up browser login prompt and Microsoft’s servers, AUTHENTIC ANTICS sets up a “Navigating” event handler to intercept the web request and extract the authorisation code... As well as the authorisation code, the username and password are also extracted from the intercepted request for exfiltration.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A sophisticated malware reportedly deployed by APT28 as part of its operations.
Credential-stealing malware that runs inside the Outlook process and presents fake login prompts to capture credentials; attributed by UK NCSC to APT28.
Authentic Antics is a malware that operates within the Microsoft Outlook process, displaying fake login prompts to steal user credentials and OAuth 2.0 tokens, which are then exfiltrated to attacker-controlled email addresses.
Newly attributed APT28 malware family designed for persistent endpoint access to Microsoft cloud accounts by blending in with legitimate activity; periodically displays a login window to harvest credentials and steals data via email.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.