Russian hackers bypass Gmail MFA using stolen app passwords

UNC6293 — a Russian-linked threat actor likely associated with APT29 — executed a slow, highly personalized spearphishing campaign targeting academics and critics of Russia by impersonating U.S. State Department officials and convincing victims to create and share Google app-specific passwords, thereby bypassing MFA and granting full access to Gmail accounts; investigators from Google Threat Intelligence Group and The Citizen Lab observed fake identities, instructional PDFs, residential proxies/VPS infrastructure, and recommend increased protections such as Google's Advanced Protection Program.