Midnight Blizzard-Linked Actor GTG-20006 Automated Device Code Phishing With AI

On September 10, 2026, Anthropic published its latest threat intelligence report. One of the operations it documents, tracked as GTG-20006 and linked to the Russian espionage actor commonly called Midnight Blizzard, targeted more than 20 government ministries, defense and intelligence bodies, embassies, and think tanks across Ukraine and Europe. The operators used AI to the entire phishing operation: registering domains, building and rebuilding phishing infrastructure, and managing a device code phishing campaign against cloud email services.

What GTG-20006 actually did

According to Anthropic's report and corroborating coverage from CyberScoop, the campaign combined several techniques that individually are not new. What changed is who was doing the assembly work.

• Device code phishing against cloud email, run through an operator framework the actor calls Embassy Kit. This was the campaign's primary access technique.
• Mail record theft at scale. Anthropic reports the access and exfiltration of mail records from at least eight organizations, including a national prosecutor office, a military education institute, and a regional intergovernmental organization. In some cases exfiltration was achieved through bulk exports from compromised mailboxes.
• DNS hijacking of compromised hotel WiFi vendors, giving the actor a position to intercept traffic from travelling diplomatic and defense staff.
• ClickFix-style malware delivery across Windows, Android, and iOS, with AI agents autonomously modifying and rebuilding the malware to evade detection.
• Bulk credential and registry theft. A separate intrusion under the same operation exfiltrated more than 300,000 national identity records from a North African government agency, plus commercial registry data on more than half a million companies.

Anthropic states that a majority of the operations described in the report were enabled by AI through direct execution or orchestration. The sophistication that used to mark an operation as state-sponsored no longer requires a large specialist team behind it.

Device code phishing, and why Embassy Kit is the interesting part

Device code phishing abuses the OAuth 2.0 Device Authorization Grant, the legitimate sign-in flow built for hardware with no keyboard, such as smart TVs and CLI tools. The victim receives a short alphanumeric code and an instruction to enter it at a real Microsoft sign-in URL. They authenticate with their own password and complete their own MFA on genuine Microsoft infrastructure. The single step that compromises the account is typing the code, which authorizes the attacker's session rather than their own.

MFA is not bypassed in the sense of being defeated. It succeeds, correctly, on behalf of the wrong party. We covered the mechanics and the defensive options in detail in our analysis of the Kali365 device code phishing kit, and the technique is identical here.

What is new in GTG-20006 is Embassy Kit: the actor's own framework for managing device code phishing at campaign scale, operated with AI assistance rather than by hand. A commercial kit sold to subscribers is one problem. A state actor running an equivalent framework, with an agent handling infrastructure churn, is a different rate of fire.

Can AI actually run a phishing campaign end to end?

On the evidence in this report, yes, with a human directing it. GTG-20006 used AI for domain registration, phishing infrastructure construction, malware rebuilding for evasion, and account takeover tooling including WhatsApp compromise through headless browsers. The human role compressed toward target selection and intent. The operational work that used to require a team of engineers was delegated.

That is the finding with the longest shelf life. Everything else in the report is a technique that will rotate. The automation of the work itself does not rotate back.

Why rule-based email security has nothing to match on

Legacy secure email gateways were architected on an assumption about tempo: an attacker builds infrastructure slowly enough that a rule written after the first wave will still catch the second. Reputation lists, domain age heuristics, and signature updates all inherit that assumption.

Device code phishing removes most of what those controls inspect. The URL in the lure is Microsoft's real device login endpoint, so URL reputation finds nothing. There is no credential form to fingerprint and no attachment to detonate. The message is a short piece of plausible business correspondence carrying a code. When an AI agent is also regenerating domains and rebuilding malware faster than the rules can be updated, the remaining detection surface is the request itself: whether a recipient has any reason to be authorizing a device they never initiated.

That is a judgment about context, not a pattern match. It is the kind of call a security analyst makes in about fifteen seconds and a static rule cannot make at all.

MITRE ATT&CK mapping

This mapping is AegisAI's reading of the behaviors described in Anthropic's report, not a mapping published by Anthropic.

What security teams should do now

Block the device code flow in Conditional Access. Most workforces have no legitimate need for it. A Microsoft Entra ID policy blocking device code authentication for all users, with a documented exception for emergency access accounts, removes the technique from the environment. This is the FBI's own recommended mitigation and it is the single highest-value control against this campaign.

Audit existing grants rather than resetting passwords. A refresh token issued through device code survives a password reset. Revoking it requires explicitly pulling the device or application grant. Review recent device code sign-ins and OAuth consents for anything unrecognized.

Retrain on the request, not the destination. Check the URL guidance does not apply when the URL is genuine. The tell is being asked to authorize a device or enter a code for something the recipient never started.

Assume infrastructure indicators decay faster than they used to. If an agent is rebuilding malware and rotating domains autonomously, a blocklist built from last week's campaign is documentation, not a control.

AegisAI evaluates every message for intent and context rather than scoring it against known-bad infrastructure, and retracts messages already delivered before users see or click them. If you want to see how a device code lure is classified when there is no malicious domain, attachment, or credential form in it, book a demo or read more about our inbound email security approach.

Sources: Anthropic, Countering misuse of AI: September 2026 (anthropic.com, September 10, 2026); CyberScoop, AI lets small actors run state-level hacking campaigns, Anthropic report finds, September 10, 2026.