Russian Cyber Espionage Infrastructure Uses Evilginx and OAuth Phishing to Steal Accounts

Russian-linked cyber espionage operators are expanding account-compromise operations by combining OAuth abuse, device-code phishing, credential-harvesting infrastructure, and suspected Evilginx reverse-proxy setups.

GTIG assesses with moderate confidence that UNC6293 is an initial-access subcluster of ICE RELIC, formerly tracked as APT29, Cozy Bear, and Midnight Blizzard.

Rather than exploiting a software flaw, the operators abuse legitimate authentication workflows and convince victims to authorize attacker-controlled access.

This approach weakens the practical protection offered by MFA because the victim completes the real authentication process before handing over a code, token-bearing URL, or OAuth authorization.

The infrastructure analysis published by Validin on August 26 expands the known UNC6293 footprint beyond the domains named by Google.

GTIG identified foreignrelations[.]us and dosportal[.]app as lures used in OAuth phishing activity.

Historical WHOIS data associated foreignrelations[.]us with the registrant email given956[@]2200freefonts[.]com, which also registered internationalaffairsportal[.]us and stateaffairs[.]us through Dynadot around the same period.

The registration overlap does not independently prove attribution, but it provides defenders with a meaningful monitoring pivot.

The lure infrastructure appears designed to support highly targeted social engineering.

Archived content from foreignrelations[.]us referenced a Council on Foreign Relations article, while analysts found related web-content signals, including the Council on Foreign Relations Facebook App ID meta tag, on other domains and IP addresses.

Such artifacts can reveal copied web templates, proxying behavior, or infrastructure used to replicate trusted policy and diplomatic content.

Google Threat Intelligence Group (GTIG) has linked the activity to three distinct clusters UNC6293, UNC7005, and UNC5976 targeting individuals in academia, government, aerospace, defense, and think tanks across Europe and the United States.

More concerningly, Validin observed probable Evilginx-style behavior on subdomains of stateaffairs[.]us between January 13 and February 2, 2026.

Russian Cyber Espionage

The infrastructure redirected users to legitimate U.S. Department of State websites, a characteristic consistent with adversary-in-the-middle phishing frameworks that proxy legitimate login flows and capture session material.

A similar configuration appeared on the-washington-ballet[.]com, which redirected visitors to the legitimate Washington Ballet events page.

Evilginx and comparable reverse-proxy phishing kits are particularly effective because they can make a fraudulent interaction appear legitimate until the attacker captures credentials, session cookies, or authorization artifacts.

In this campaign, the apparent blend of polished decoy sites, legitimate redirects, and OAuth prompts reduces the chance that targets will recognize the attack before account access is granted.

UNC7005, which GTIG tracks separately because of weaker operational security and use of malware, also overlaps with UNC6293’s targeting priorities.

The cluster used Microsoft device-code phishing and targeted WhatsApp accounts through device-linking lures.

Its infrastructure included my-invite[.]org, which resolved to 104.194.159[.]150 and hosted changing event-themed decoys, including a fake GLOBSEC Forum 2026 invitation referencing Prague.

The IP 93.127.160[.]28 (AS 47447 – TTM – 23 GmbH, Germany) looked promising as a pivot because it appeared to be a dedicated IP with relatively few associated domains.

UNC5976 focused on Google-themed OAuth phishing, including drive[.]google[.]verify-drive[.]com, which used the title “My Drive – Google Drive.”

Validin linked the operation to domains with similar registration timing, HTTP-header characteristics, favicon reuse, and hosting patterns.

The favicon MD5 hash c66f20f2e39eb2f6a0a4cdbe0d955e5f surfaced across a limited set of domains, including the net-new candidate fileshareapp[.]org, making it a valuable hunting artifact when correlated with certificate and response-content data.

Organizations should treat unexpected OAuth consent requests, app-password requests, device-code prompts, and demands for a “verification code” or copied login URL as account-compromise attempts.

Security teams should hunt for the listed domains and IP infrastructure, but avoid blocking every pivoted domain without validation because DNS overlap, recycled hosting, and dangling records can create false positives.

The more durable detection strategy is behavioral: alert on unfamiliar OAuth applications, newly granted high-risk scopes, anomalous device-linking activity, token use from unusual networks, and suspicious mailbox-rule creation after authentication.

Google’s reporting underscores that these campaigns exploit trust in legitimate identity services not flaws in the services themselves making user verification and OAuth governance central to defense.

IOCs

Type	Indicator
Possible origin IP	151.236.15[.]213
Possible origin IP	185.158.250[.]155
Domain	fllefolder[.]com
Domain	sharefolders[.]org
Subdomain	drive[.]google[.]sharefolders[.]org
Domain	formshare[.]cloud
Subdomain	drive[.]google[.]formshare[.]cloud
Domain	sharedfolders[.]org

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide