Topic starter
02/08/2026 12:27 pm
TL;DR: About 10% of visitors were redirected, showing how selective watering-hole tactics can keep credential-harvesting campaigns quiet, in Anomali’s case work on APT29. Device code approval paths need stronger validation, logging, and anomaly detection because a small amount of abuse can still reach account access.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Anomali Cyber Watch: APT 29, APT37, Silver Fox, Grok AI Exploits, and More”.
Key questions
Q: Why does selective redirection make credential-harvesting campaigns harder to detect?
A: Selective redirection reduces noise, so only a small fraction of users encounter the malicious path.
Q: What are the signs that a watering-hole credential campaign is active?
A: Look for legitimate sites serving unexpected client-side scripts, unusual redirects to verification pages, and spikes in authentication activity that do not match user intent.
Q: What breaks when attackers abuse device code authentication flows?
A: The assumption that a user approval step is inherently trustworthy breaks down.
Practitioner guidance
- Harden device code approval flows Add stronger verification around device code prompts, including user education on where approval pages originate and how legitimate flows should appear.
- Monitor for injected JavaScript and malicious redirects Review high-trust websites and externally facing properties for unexpected client-side redirection, script injection, and verification-page impersonation.
- Correlate low-volume web abuse signals Look for sparse but repeated redirect patterns, unusual verification-page visits, and authentication anomalies that would not stand out in bulk phishing telemetry.
Bottom line: This campaign shows that identity abuse can begin in the browser long before a password or token is captured.
Glossary terms: Device Code Flow, Watering Hole Attack, Credential Harvesting, Approval Phishing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:25 pm
Authentication trust paths are now a primary abuse surface: This campaign did not depend on malware delivery alone. It succeeded by subverting the moment where a user decides a login request is legitimate, which makes the authentication journey itself part of the attack surface. For IAM teams, that means phishing resistance has to extend beyond passwords and toward the legitimacy of the approval path.
A question worth separating out:
Q: How should organisations respond when device approval is being used as a phishing vector?
A: They should treat the approval step as a sensitive control point, tighten user guidance, instrument the flow with logging and anomaly detection, and review whether the verification page or redirect chain can be spoofed. If the approval surface cannot be trusted, the authentication design is already too permissive.
👉 Read our full editorial: Credential-harvesting campaigns are exploiting device code flow