Russia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European Organizations

Google Threat Intelligence Group details Russia-linked espionage clusters (UNC6293, UNC7005, UNC5976) using OAuth phishing, device-code phishing, spoofed websites, and Cloudflare-fronted infrastructure to impersonate trusted organizations and harvest access to email, cloud, and messaging accounts; researchers identified multiple domains, IPs, registration overlaps, and evidence consistent with Evilginx-style phishing and targeted lures against academia and think tanks in the United States and Europe.