Authentic Antics
Authentic Antics is a Windows malware family attributed by the UK NCSC to APT28 / GRU Unit 26165. It is designed to obtain persistent access to Microsoft cloud accounts by operating inside the Microsoft Outlook process and blending with legitimate Microsoft authentication activity. The malware displays periodic fake Microsoft login prompts within Outlook to steal Microsoft Office credentials and OAuth 2.0 tokens, enabling unauthorized access to victim email accounts and potentially Exchange Online, SharePoint, and OneDrive depending on tenant configuration.
Observed in 2023, Authentic Antics uses a dropper DLL named Microsoft.Identity64.dll to decrypt and load an in-memory .NET stealer payload named Microsoft.Identity.Client.dll. Persistence is achieved via COM hijacking by replacing the InprocServer32 path for CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27}, which normally points to npmproxy.dll used by Outlook at startup. It limits execution using the registry key HKCU\Software\Microsoft\Office\16.0\Outlook\Logging\Counter and stores the most recently stolen refresh token in HKCU\Software\Microsoft\Office\16.0\Outlook\Logging\Locale.
The malware includes multiple defense-evasion and anti-analysis measures. It uses heavy string obfuscation, verifies it is running inside outlook.exe, checks for the OutlookGrid window class and the victim identity in the window title, and restores suspected hooked ntdll.dll registry functions from a clean mapped copy. It also hooks IEConfiguration_GetBool in iertutil.dll and uses environmental keying: the embedded stealer payload is AES-256 encrypted with a machine-specific key derived from the MachineGuid in HKLM\Software\Microsoft\Cryptography and the C: drive volume serial number, or the computer name if MachineGuid is absent.
For credential theft, Authentic Antics enumerates Office identity data under HKCU\Software\Microsoft\Office\16.0\Common\Identity\Identities, selects the most recently used account, and targets ADAL-backed identities. It creates a controlled browser window inside Outlook and directs it to login.microsoftonline.com/common/oauth2/authorize using the Microsoft Office client ID d3590ed6-52b3-4102-aeff-aad2292ab01c. It intercepts the browser navigation flow to capture authorization codes, usernames, and passwords, then redeems authorization codes or refresh tokens via HTTPS POST requests to https://login.microsoftonline.com/common/oauth2/token.
Authentic Antics does not rely on traditional command-and-control infrastructure. It communicates only with legitimate services, including Microsoft OAuth endpoints, Outlook web APIs, and http://www.gstatic.com/generate_204 for connectivity checks. Exfiltration is performed by sending stolen credential and token data from the victim's own Outlook account to an actor-controlled email address via https://outlook.office.com/api/v2.0/me/sendMail. The data is gzip-compressed and RSA-2048 encrypted, and the malware sets SaveToSentItems to false so the exfiltration email does not appear in the victim's Sent Items.
High-confidence indicators and artifacts mentioned in the reporting include the filenames Microsoft.Identity64.dll and Microsoft.Identity.Client.dll, the hijacked CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27}, the suspicious registry values under HKCU\Software\Microsoft\Office\16.0\Outlook\Logging\Counter and ...\Locale, use of login.microsoftonline.com/common/oauth2/authorize and /common/oauth2/token, the Outlook API endpoint outlook.office.com/api/v2.0/me/sendMail, and the Microsoft Office OAuth client ID d3590ed6-52b3-4102-aeff-aad2292ab01c.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The UK's cybersecurity agency published in May a report on a new malware strain named AUTHENTIC ANTICS. The malware runs in the Outlook process to show fake login screens and steal account credentials. On Friday, the UK NCSC linked the malware to Russian cyber-espionage group APT28.
Along with the sanctions, the UK also attributed a new malware family to APT28. Dubbed Authentic Antics (PDF), the malware was “specifically designed to enable persistent endpoint access to Microsoft cloud accounts by blending in with legitimate activity”.
Along with the sanctions, the UK also attributed a new malware family to APT28. Dubbed Authentic Antics (PDF), the malware was “specifically designed to enable persistent endpoint access to Microsoft cloud accounts by blending in with legitimate activity”.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 techniqueAUTHENTIC ANTICS is persisted via COM Hijacking. The path to the loader, Microsoft.Identity64.dll is placed in the registry key HKLM\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 this normally contains the path to npmproxy.dll which is called by Outlook on startup.
Privilege Escalation
1 techniqueAUTHENTIC ANTICS is persisted via COM Hijacking. The path to the loader, Microsoft.Identity64.dll is placed in the registry key HKLM\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 this normally contains the path to npmproxy.dll which is called by Outlook on startup.
Stealth
3 techniquesAUTHENTIC ANTICS stealer payload is embedded within the loader and is encrypted with AES-256. The key used to decrypt the payload is derived from machine-specific data, meaning it is keyed to the victim machine and will not decrypt unless it is running on the intended target device.
AUTHENTIC ANTICS ensures it is running within the Outlook process by checking its running threads Window Class and Window Text against values for the legitimate Outlook process.
The decryption key is generated by XORing the MachineGuid value taken from the registry key HKLM\Software\Microsoft\Cryptography and the Volume Serial Number of the C: drive. If a MachineGuid is not present, then the computer name is used instead.
Credential Access
3 techniquesTo steal tokens, AUTHENTIC ANTICS will generate a pop-up browser window it controls from within the Outlook process and direct it to Microsoft’s Authorization Server, login.microsoftonline.com specifically the /authorize endpoint...
To be able to intercept the data sent between the created pop-up browser login prompt and Microsoft’s servers, AUTHENTIC ANTICS sets up a “Navigating” event handler to intercept the web request and extract the authorisation code... As well as the authorisation code, the username and password are also extracted from the intercepted request for exfiltration.
this low-effort campaign has empowered the threat actor to sniff Web traffic with aplomb and steal credentials for email and Web services on an ongoing basis.
Collection
1 techniqueTo be able to intercept the data sent between the created pop-up browser login prompt and Microsoft’s servers, AUTHENTIC ANTICS sets up a “Navigating” event handler to intercept the web request and extract the authorisation code... As well as the authorisation code, the username and password are also extracted from the intercepted request for exfiltration.
Exfiltration
1 techniqueTo exfiltrate collected credential and token data, the malware uses its access to the victim’s Outlook account to email an actor-controlled email address... sent to the Outlook API URL https://outlook[.]office[.]com/api/v2.0/me/sendMail.
Other
1 techniqueRecent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential-stealing malware that runs inside the Outlook process and presents fake login prompts to capture credentials; attributed by UK NCSC to APT28.
Authentic Antics is a malware that operates within the Microsoft Outlook process, displaying fake login prompts to steal user credentials and OAuth 2.0 tokens, which are then exfiltrated to attacker-controlled email addresses.
Newly attributed APT28 malware family designed for persistent endpoint access to Microsoft cloud accounts by blending in with legitimate activity; periodically displays a login window to harvest credentials and steals data via email.
Highly targeted Windows malware that runs inside Outlook, displays malicious Microsoft login prompts, steals credentials and OAuth 2.0 authorization codes/tokens, validates refresh tokens, and exfiltrates stolen data by sending email from the victim's Outlook account via legitimate Microsoft services while using extensive defense evasion such as environmental keying, COM hijacking persistence, string obfuscation, and ntdll unhooking.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.