Russian snoops add OAuth abuse to targeted phishing campaigns

Google has identified three distinct groups of Russian cyber-spies – UNC6293, UNC7005, and UNC5976 – that are aggressively targeting individuals in academia, defense, government, and think tanks across Europe and the US. These groups are utilizing sophisticated phishing tactics, including OAuth abuse and device-code phishing, to gain long-term access to accounts and deploy malware, often impersonating organizations like the US State Department. The threat is particularly concerning due to the groups' use of AI-assisted operations and their ability to blend in with legitimate communications.