Russian-linked cyber espionage operators are expanding account-compromise operations by combining OAuth abuse, device-code phishing, credential-harvesting infrastructure, and suspected Evilginx reverse-proxy setups. GTIG assesses with moderate confidence that UNC6293 is an initial-access subcluster of ICE RELIC, formerly tracked as APT29, Cozy Bear, and Midnight Blizzard. Rather than exploiting a software flaw, the operators abuse legitimate authentication […]
The post Russian Cyber Espionage Infrastructure Uses Evilginx and OAuth Phishing to Steal Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.