Russian Phishing Clusters Exploit Legit Auth Flows

Google’s Threat Intelligence Group (GTIG) has been busy tracking three distinct Russian cyber espionage clusters that are abusing legitimate authentication flows to target academics, defense personnel, and think tanks across Europe and the US. These aren’t your run-of-the-mill phishers; they’re sophisticated operators who’ve figured out how to swim through the swamp without making a splash.

By exploiting features like app passwords, OAuth, and device linking, these clusters can compromise accounts without triggering the usual alarms. It’s like a caiman sneaking into a capybara’s pool—by the time you notice, it’s already too late.

UNC6293: The Persistent App Password Phisher

UNC6293, likely a subcluster of the infamous APT29 (aka ICE RELIC), has been running app password phishing campaigns since at least June 2025. They impersonate US State Department officials and trick targets into setting app passwords that the attackers then use to access accounts, bypassing 2FA.

Their lures are small-scale but highly targeted, often focusing on diplomatic themes and upcoming conferences. They’ve evolved to include OAuth phishing, where victims are tricked into sharing verification codes after logging in legitimately.

UNC7005: The Opportunistic All-Rounder

UNC7005 (aka STORM-2945) is a bit less polished but more versatile. They’ve been spotted doing app password phishing, device code phishing for Microsoft and WhatsApp, and even deploying malware like VIDAR and ATOMIC stealers. Their phishing pages are often elaborate, with fake conference registrations and even a wine selection (a nod to previous APT29 campaigns).

They’ve also been linked to the hospitality captive portal campaign that redirects hotel guests to fake Microsoft login pages. It’s a clever way to catch travelers off guard, especially those attending conferences.

UNC5976: The OAuth Automation Specialist

UNC5976 is a distinct cluster that focuses on OAuth phishing, using fake file-sharing pages and cloud projects to steal authentication tokens. They’ve been particularly active against military and aerospace targets in Ukraine and Armenia, and they’re not shy about using malware like the HEADRUSH Excel plugin.

They’re also quick to adapt, creating new domains and infrastructure within months of being disrupted. GTIG notes they’re now migrating away from Google infrastructure to other providers.

What This Means for Developers and Users

These clusters are a reminder that authentication flows, while convenient, can be weaponized. For developers, it’s crucial to implement robust security measures like the Supabase or Firebase platforms, which offer built-in security features. But even with the best tools, user education is key.

GTIG recommends users be wary of unsolicited invitations, verify URLs before entering credentials, and avoid using app passwords unless absolutely necessary. For high-risk individuals, the Advanced Protection Program is a solid defense.

Staying Safe in the Swamp

As these clusters continue to evolve, it’s essential to stay vigilant. Check for suspicious links, enable two-factor authentication, and regularly audit linked devices. And if you’re a developer, consider using platforms like Cloudflare Workers or Neon Database that prioritize security.

Remember, in the digital swamp, it’s better to be a cautious capybara than a complacent one. Stay sharp, and don’t let the caimans catch you off guard.

Original announcement published on Google Cloud.