Amazon disrupts watering hole campaign by Russia’s APT29 | AWS Security Blog

Amazon has disrupted a sophisticated APT29 watering hole campaign that compromised legitimate websites to redirect users into authorizing attacker-controlled devices via Microsoft’s authentication flow, demonstrating the group’s evolving credential-harvesting tactics and rapid adaptation to countermeasures.