#unc6293

[cyber-sec]

Gmail’s multi-factor authentication bypassed in phishing attacks

A state-linked Russian threat actor exploited Google’s app password system to bypass MFA, targeting prominent critics and academics. The phishing campaign manipulated trust through detailed impersonation and social engineering.

Google Threat Intelligence Group confirms that a Russia-affiliated group bypassed Gmail’s multi-factor authentication by tricking targets into generating app-specific passwords. These 16-digit codes, meant for legacy apps, were obtained through phishing emails disguised as U.S. State Department communications. This method gave attackers persistent inbox access, highlighting the overlooked risk of app passwords in otherwise secure accounts.

Sources: Malwarebytes | Google Cloud Blog