Russian cyber snoops linked to massive credential-stealing campaign

Citizen Lab attributes a multi-year Russian FSB-linked phishing campaign, dubbed "River of Phish," to the COLDRIVER group and a second actor COLDWASTREL; the campaign (since 2022) uses spear-phishing PDFs, browser fingerprinting and phishing pages to steal credentials and 2FA tokens from exiled Russian opposition, NGOs, media, think tanks, defense-industry and government personnel across the US and Europe — no malware was observed, but credential theft poses significant personal and national security risks.