#unc6293

Google Threat Intelligence Group confirms that a Russia-affiliated group bypassed Gmail’s multi-factor authentication by tricking targets into generating app-specific passwords. These 16-digit codes, meant for legacy apps, were obtained through phishing emails disguised as U.S. State Department communications. This method gave attackers persistent inbox access, highlighting the overlooked risk of app passwords in otherwise secure accounts.