The fake conference registration page asked the guest to choose a wine. It is an odd thing to build into a phishing site, and that is rather the point: an invitation that bothers with an epicurean wine selection reads like an invitation, not like an attack. Once the target had picked, the page asked them to verify their identity and showed them a short code to type into a genuine Microsoft sign-in screen.
That last step is the entire attack. There is no fake login page anywhere in it.
Google Threat Intelligence Group published research on August 20, written by Gabby Roncone and Wesley Shields, tracking three separate suspected Russian cyber espionage clusters that have converged on the same idea. Rather than steal a password, persuade the target to grant access through a login flow that Microsoft, Google or WhatsApp built and runs. The clusters, tracked as UNC6293, UNC7005 and UNC5976, target academics, diplomats, think tank staff and people working in aerospace and defence across Europe, Ukraine and the United States. GTIG says it is publishing partly so that the people being targeted can recognise the approach, because the operations do not look like phishing to the person on the receiving end.
Why nobody needs your password
The oldest of the three techniques in the report is app password phishing. An app password is a code you generate so an older device or program can reach your mailbox without going through the normal login. It skips two-factor authentication by design, which is exactly why it is useful to somebody who does not have your second factor. Google's advice in the report is blunt: most people never need one.
GTIG assesses with moderate confidence that UNC6293 is an initial-access sub-cluster of the group it now calls ICE RELIC, formerly APT29. Since 2025 the cluster has impersonated US State Department officials and talked targets into creating an app password named ms.state.gov, walking them through it with a PDF full of screenshots of the settings pages. In October 2025 GTIG saw the same screenshots reused, unchanged. What did change is the collection method. In 2025 the attacker asked victims to email the password back. In the newer operations, the target is asked to type it into a form on a website that looks legitimate. By June 2026 the cluster had added OAuth phishing, asking targets to hand over a verification code after a real login at an external provider.
A lure that checks whether a researcher is looking
UNC7005, which Microsoft tracks as Storm-2945, is the noisiest and most inventive of the three. Its device code phishing waves masquerade as invitations to calls and diplomatic events. In May 2026 it spoofed the GLOBSEC forum, reusing a website template from an embassy-themed operation the month before, and left a tell behind: the identity verification prompt on the GLOBSEC page still referred to embassy security policy, an artifact from the earlier job.
The pages fingerprint whoever visits. GTIG recovered the JavaScript, which collects screen size, timezone, language, platform, CPU cores and memory and posts it to the server before anything else happens. A later version went further and specifically hunted for automated analysis, checking for the webdriver flag that Selenium and Puppeteer set, for a browser reporting no languages at all, and for a missing Chrome runtime object. If any check tripped, the page wiped its own HTML and stopped loading. The actor rebuilt that template within days of GTIG spotting the first one, blaming technical difficulties in the page text while quietly changing the questions and the colour scheme.
Linking a device is not the same as logging in
The most uncomfortable technique in the report has nothing to do with corporate email. In May and June 2026, UNC7005 ran pages that invited targets to join a secure WhatsApp call, chat or file share. The page asks for a phone number, uses it to raise a genuine WhatsApp device link request against an attacker-controlled device, and then displays the real QR and linking code to the victim with instructions to scan it. The victim links their account to a stranger's device using WhatsApp's own feature, working exactly as designed.
Then the page keeps going. If the target picks the voice call option, GTIG found JavaScript that quietly requests camera and microphone access, records audio and video while showing a fake ringing screen, and uploads the recording to the attacker's server when the call conveniently fails. The encrypted chat option hands the target credentials and a second login URL. The file share option renders a download button, though GTIG says it could not establish what file was staged behind it.
A broader wave in late May took a cruder route. Targets who clicked through to a page about a summit resolution on Ukraine were served commodity infostealer malware chosen by their user agent: VIDAR on Windows, ATOMIC on macOS, both rented rather than built. The site even listed contact details for the threat actor in case of technical difficulties.
The hotel Wi-Fi campaign was the same crew
In July, travellers began hitting attacker-controlled Microsoft login pages through captive portals on hotel and conference centre networks. IntelFusions covered that campaign when Russian operators were found hijacking hotel Wi-Fi to reach travellers. GTIG has now tied that infrastructure back to the rest of UNC7005's work, and the join is mundane registration hygiene. Three Outlook-themed domains used in the captive portal campaign were registered with the same email address as an earlier Microsoft-spoofing domain, and that domain shared an IP address, 104[.]194[.]159[.]150, with my-invite[.]org, the domain behind the GLOBSEC device code lure in April.
IntelFusions checked how the two vendors describe that link. Microsoft's own write-up of the captive portal campaign, published on July 31, states without qualification that Storm-2945 is "an operational sub-cluster of Midnight Blizzard". Google, looking at the same cluster under a different name, attaches only moderate confidence to the equivalent link to ICE RELIC. Midnight Blizzard and ICE RELIC are the same group. Two vendors with visibility into the same infrastructure are describing the same relationship at meaningfully different levels of certainty, which is worth knowing if you are reading either report as settled attribution.
What this does and does not establish
The clusters are tracked separately for reasons GTIG spells out: UNC7005 has weaker operational security, different infrastructure characteristics and a willingness to use rented malware that UNC6293 does not show. UNC5976, which runs OAuth phishing off purchased file-sharing domains and cloud projects that harvest tokens, is assessed as distinct from both. None of that is a claim that three groups are one group, and GTIG does not make it. What the report does establish is a shared technique, not a shared team.
Revoke the app passwords, audit the linked devices
Google's guidance is specific and mostly free. Remove app passwords tied to devices you no longer use, and remove any you created in response to an approach like these; they can be revoked at any time. High-risk users should look at the Advanced Protection Program, which blocks app password creation outright. Google Workspace administrators can restrict two-step verification to security keys only, which has the same effect across a tenant.
For messaging apps, the report asks organisations and high-risk individuals to build linked-device audits into routine checks on both corporate and personal phones, enforce registration locks and two-factor authentication so a stolen SMS code cannot re-register an account, and use safety numbers verified over a different channel to confirm who they are talking to. IntelFusions has covered how device code phishing hijacks Microsoft 365 accounts through Microsoft's own login page, and the defensive problem is the same one: the flow is legitimate, so the only place to catch it is the human being asked to complete it.
The common thread across all three clusters is that the security control worked and the person was talked past it. An app password, a device link and an OAuth consent are all features, granted deliberately, by someone who believed they were doing something else. That is a harder thing to detect than a stolen password, and a much harder thing to patch.
Selected indicators
Defanged, from GTIG's report. Domains: chamber-ua[.]org, wa-connect[.]eu, wa-device[.]com, my-invite[.]org, globsec[.]net, statistic-ms[.]live, owa-ms365[.]com, foreignrelations[.]us. IP addresses: 104[.]194[.]159[.]150, 107[.]189[.]18[.]7 (VIDAR command and control), 196[.]251[.]107[.]171, 31[.]57[.]243[.]154, 38[.]146[.]28[.]75. Full indicator tables are in the original report.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.