Storm-2372 is a sophisticated nation-state threat actor, with moderate to high confidence of Russian origin, that has been conducting an advanced device code phishing campaign against Microsoft 365 environments since August 2024. This threat actor exploits legitimate Microsoft OAuth 2.0 authentication flows to steal user credentials and bypass multi-factor authentication (MFA), gaining persistent access to organizational resources across government, NGO, IT services, defense, telecommunications, healthcare, education, and energy sectors in Europe, North America, Africa, and the Middle East.