Russian-Linked Cyber Espionage Campaign Expands OAuth and Phishing Tactics A sophisticated cyber espionage campaign linked to Russian threat actors including UNC6293, a subcluster of ICE RELIC (APT29/Cozy Bear/Midnight Blizzard) is escalating account-compromise operations by abusing legitimate authentication workflows. The campaign combines OAuth phishing, device-code attacks, credential-harvesting infrastructure, and suspected Evilginx reverse-proxy setups to bypass multi-factor authentication (MFA) protections. ### Key Tactics and Infrastructure The attackers exploit trust in authentication processes rather than software vulnerabilities, tricking victims into authorizing attacker-controlled access. This method undermines MFA by convincing targets to complete legitimate logins before handing over tokens or OAuth permissions. Lure Domains and Social Engineering - foreignrelations[.]us and dosportal[.]app were identified as OAuth phishing lures, with historical WHOIS data linking them to the registrant email given956[@]2200freefonts[.]com, which also registered internationalaffairsportal[.]us and stateaffairs[.]us. - Archived content on foreignrelations[.]us referenced a Council on Foreign Relations article, while other domains reused web templates and meta tags to mimic trusted diplomatic and policy content. - Evilginx-style behavior was observed on stateaffairs[.]us subdomains between January 13 and February 2, 2026, redirecting users to legitimate U.S. Department of State sites to capture session credentials. Additional Threat Clusters - UNC7005, tracked separately due to weaker operational security, used Microsoft device-code phishing and targeted WhatsApp accounts via fake event invitations (e.g., a spoofed GLOBSEC Forum 2026 lure hosted on my-invite[.]org). - UNC5976 focused on Google-themed OAuth phishing, including drive[.]google[.]verify-drive[.]com, which mimicked Google Drive with a decoy login page. A shared favicon hash (c66f20f2e39eb2f6a0a4cdbe0d955e5f) linked multiple domains, aiding detection. ### Targets and Impact The campaign primarily targets academia, government, aerospace, defense, and think tanks across Europe and the U.S.. By blending polished decoy sites, legitimate redirects, and OAuth prompts, the attackers reduce the likelihood of detection before account access is compromised. ### Indicators of Compromise (IOCs) - IPs: 151.236.15[.]213, 185.158.250[.]155 - Domains: fllefolder[.]com, sharefolders[.]org, formshare[.]cloud, sharedfolders[.]org - Subdomains: drive[.]google[.]sharefolders[.]org, drive[.]google[.]formshare[.]cloud The campaign highlights the growing threat of adversary-in-the-middle (AitM) phishing frameworks, which exploit trust in identity services rather than technical flaws. Organizations are advised to monitor for unexpected OAuth consent requests, device-code prompts, and anomalous token usage to mitigate exposure.