Gmail Users Beware: APT29 Sidesteps 2FA in Stealth Attack

Google’s Threat Intelligence Group (GTIG) and Citizen Lab have uncovered a highly targeted phishing campaign linked to Russia-based APT29, exploiting Google App Passwords to bypass two-factor authentication (2FA) and maintain persistent access to victims’ Gmail accounts.

Impersonation Tactics and Rapport Building

From April to early June 2025, the threat actor tracked by Google as UNC6293 targeted prominent academics and Russia critics, impersonating the U.S. Department of State to lure victims into creating and sharing application-specific passwords (ASPs).

FCRF x CERT-In Roll Out National Cyber Crisis Management Course to Prepare India’s Digital Defenders

Rather than relying on urgency or fear, the attacker built trust over weeks, sending meeting invites and CCing multiple fake “@state.gov” addresses to appear legitimate. This clever tactic played on the assumption that any invalid addresses would bounce back or be flagged something that doesn’t happen due to the Department’s mail server configuration.

Once rapport was established, victims received a forged PDF guide instructing them to generate and share an app password to enable “secure communications.”

Bypassing Google’s 2FA Security

Google’s app passwords are intended to allow less secure apps or devices to access accounts protected by 2FA. In this case, the attacker used ASPs to authenticate a mail client, effectively sidestepping 2FA and accessing the victim’s email data undetected.

“This method also allows the attackers to have persistent access to accounts,” GTIG noted, further emphasizing that residential proxies and VPS servers were used to mask login origins.

Wider Campaign and APT29 Attribution

APT29 also known as Cozy Bear, Cloaked Ursa, or Midnight Blizzard is a Russian state-sponsored threat group previously linked to the SolarWinds supply chain attack and recent Microsoft 365 account compromises.

Algoritha: The Most Trusted Name in BFSI Investigations and DFIR Services

The current campaign is one in a series of sophisticated phishing techniques used by APT29-affiliated actors in 2025, including:

• Device Join Phishing – tricking users into returning Microsoft OAuth codes.
• Device Code Phishing – leveraging third-party applications to hijack identities.

Microsoft previously warned that such methods allow threat actors to register new devices to an organization’s tenant using stolen authentication tokens.

Google Response and User Advisory

Google confirmed it has secured the compromised accounts and continues to monitor the campaign. Users are advised to:

• Avoid sharing any app passwords or authentication codes
• Verify the legitimacy of unsolicited emails, even if they appear to come from official domains
• Enable alerting for suspicious login attempts
• Use hardware-based security keys for stronger protection