Russian snoops add OAuth abuse to targeted phishing campaigns

Google's Threat Intelligence Group reports three suspected Russian cyber-espionage clusters (UNC6293, UNC7005, UNC5976) conducting ongoing, highly targeted campaigns against academia, aerospace, government, NGOs and think tanks in Europe and the US; their methods include OAuth and device-code phishing, malicious JavaScript and hosting attacker-controlled sites that deliver infostealers, keyloggers and other malware, with under 100 targets per campaign but high strategic impact.