UNK_AcademicFlare
UNK_AcademicFlare is a suspected Russia-aligned threat actor tracked by Proofpoint. Since at least September 2025, the group has conducted device code phishing campaigns that abuse Microsoft OAuth 2.0 device authorization workflows to steal Microsoft 365 credentials and obtain tokens for account takeover. The actor uses compromised government and military email accounts to build rapport with targets and then sends links, including Cloudflare Worker URLs spoofing OneDrive, that direct victims into a device code phishing flow on legitimate Microsoft device login pages. Reported targets include government, think tanks, higher education/academic organizations, and transportation sectors in the U.S. and Europe. The activity is described as sophisticated social engineering and is part of broader Russia-aligned adoption of device code phishing. No additional aliases or sub-groups are directly supported in the provided content beyond the tracked name UNK_AcademicFlare.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a Russian threat group that has used device code phishing attacks to hijack Microsoft accounts.
Named activity cluster attributed as Russia-aligned and linked to device code phishing attacks against Microsoft 365 identities.
Russia-aligned/suspected Russia-aligned phishing activity using Microsoft 365 device-code phishing to steal credentials and perform account takeovers.
UNK_AcademicFlare is a suspected Russia-aligned threat group conducting sophisticated social engineering and OAuth device code phishing campaigns targeting government officials, think tank researchers, and university staff.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.