build1 distinct publisher
Three Russian clusters phish the grant, not the password, and MFA completion changes nothing
Google's threat intel group ties UNC6293, UNC7005 and UNC5976 to attacks on OAuth consent, app passwords, device codes and WhatsApp linking. The login succeeds; the token leaves anyway.
Publishers:dev.to
Reality
- Evidence64
- Adoption58
- Hype gap+14
- Incentives57
- Confidence55