Loading threat actor…
Storm-365 is a cybercriminal threat actor associated with Microsoft 365-focused phishing operations, particularly the adoption of device code phishing to obtain unauthorized access to cloud accounts. The group has been identified among actors that integrated abuse of Microsoft OAuth 2.0 device authorization workflows into routine operations, enabling theft of authentication tokens through legitimate Microsoft sign-in infrastructure rather than traditional fake credential-harvesting pages. This technique can provide persistent access to victim accounts and supports follow-on account compromise and business email compromise activity. Storm-365 is referenced alongside other criminal operators and phishing-service ecosystems involved in scaling device code phishing, indicating participation in financially motivated cloud-account intrusion activity rather than a clearly established nation-state mission. High-confidence public reporting in this context supports Storm-365’s use of Microsoft 365 account access theft via device code phishing, but does not provide sufficient corroborated detail to attribute specific sub-groups, geographic origin, or a defined victim-country pattern.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.