Reported by 2 outlets

Timeline

1. original reporting

   Russia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European Organizations

   cyberpress.org · 47d ago · August 27th, 2026

   Google Threat Intelligence Group (GTIG) has detailed several Russia-linked cyber espionage clusters targeting people in academia, think tanks, and other organizations in the United States and Europe. The activity involves OAuth phishing, device-code phishing, spoofed websites, and infrastructure designed to imitate trusted organizations and cloud services. The tracked clusters UNC6293, UNC7005, and UNC5976 show different levels of operational maturity. However, their campaigns rely on a common goal: convincing targets to grant attackers access to email, cloud accounts, or messaging platforms. UNC6293 used the domains foreignrelations[.]us and dosportal[.]app in OAuth phishing campaigns . The first domain was registered and became active on November 21, 2025, after years without DNS activity. Russia-Linked OAuth Phishing Campaigns Historical registration data linked foreignrelations[.]us to two additional domains: internationalaffairsportal[.]us and stateaffairs[.]us. All three were registered around the same period through Dynadot, suggesting possible infrastructure overlap. The registrant email used an address at 2200freefonts[.]com, although the font-related domain itself is not confirmed as actor-controlled. Russia-Linked OAuth Phishing Campaigns (Source: validin) The foreignrelations[.]us lure copied content associated with the Council on Foreign Relations. Analysts identified other sites sharing a Council on Foreign Relations Facebook App ID meta tag , a useful pivot for

2. update from gbhackers.com

   Russian Cyber Espionage Infrastructure Uses Evilginx and OAuth Phishing to Steal Accounts

   gbhackers.com · 47d ago · August 27th, 2026

   Russian-linked cyber espionage operators are expanding account-compromise operations by combining OAuth abuse, device-code phishing, credential-harvesting infrastructure, and suspected Evilginx reverse-proxy setups. GTIG assesses with moderate confidence that UNC6293 is an initial-access subcluster of ICE RELIC, formerly tracked as APT29, Cozy Bear, and Midnight Blizzard. Rather than exploiting a software flaw, the operators abuse legitimate authentication […] The post Russian Cyber Espionage Infrastructure Uses Evilginx and OAuth Phishing to Steal Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .