{"id":7505,"date":"2025-08-29T22:25:02","date_gmt":"2025-08-30T02:25:02","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=7505"},"modified":"2025-08-29T22:03:30","modified_gmt":"2025-08-30T02:03:30","slug":"russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/","title":{"rendered":"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot"},"content":{"rendered":"<p><a href=\"https:\/\/aws.amazon.com\/security\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Amazon<\/a> blocked a covert campaign by <a href=\"https:\/\/attack.mitre.org\/groups\/G0016\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Russia\u2019s APT29<\/a>, also known as Cozy Bear, that targeted Microsoft accounts through fake Cloudflare login pages. Hackers compromised legitimate websites, injected malicious code, and redirected visitors to attacker domains to steal access. AWS confirmed its systems stayed secure. The incident underscores how Moscow\u2019s cyber operatives keep refining their espionage playbook against Western targets.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Amazon blocked a covert campaign by Russia\u2019s APT29, also known as Cozy Bear, that targeted Microsoft accounts through fake Cloudflare login pages. Hackers compromised legitimate websites, injected malicious code, and redirected visitors to attacker domains to steal access. AWS confirmed its systems stayed secure. The incident underscores how Moscow\u2019s cyber operatives keep refining their espionage [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[4392,4394,4393,4391],"class_list":["post-7505","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-apt29-cozy-bear-attack","tag-aws-cybersecurity","tag-microsoft-phishing-campaign","tag-russia-cyber-espionage"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Amazon blocked a covert campaign by Russia\u2019s APT29, also known as Cozy Bear, that targeted Microsoft accounts through fake Cloudflare login pages. Hackers compromised legitimate websites, injected malicious code, and redirected visitors to attacker domains to steal access. AWS confirmed its systems stayed secure. The incident underscores how Moscow\u2019s cyber operatives keep refining their espionage [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2025-08-30T02:25:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-08-30T02:03:30+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/\",\"name\":\"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2025-08-30T02:25:02+00:00\",\"dateModified\":\"2025-08-30T02:03:30+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/","og_locale":"en_US","og_type":"article","og_title":"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot - Web Hosting News","og_description":"Amazon blocked a covert campaign by Russia\u2019s APT29, also known as Cozy Bear, that targeted Microsoft accounts through fake Cloudflare login pages. Hackers compromised legitimate websites, injected malicious code, and redirected visitors to attacker domains to steal access. AWS confirmed its systems stayed secure. The incident underscores how Moscow\u2019s cyber operatives keep refining their espionage [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/","og_site_name":"Web Hosting News","article_published_time":"2025-08-30T02:25:02+00:00","article_modified_time":"2025-08-30T02:03:30+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/","url":"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/","name":"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2025-08-30T02:25:02+00:00","dateModified":"2025-08-30T02:03:30+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/russias-cozy-bear-thwarted-in-latest-microsoft-credential-theft-plot\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Russia\u2019s cozy bear thwarted in latest Microsoft credential theft plot"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":163,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=7505"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7505\/revisions"}],"predecessor-version":[{"id":7506,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7505\/revisions\/7506"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=7505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=7505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=7505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}