Skip to content
Threat Feed
Subscribe

Actor

O-UNC-038

1 brief RSS
high threat

Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials

O-UNC-038 is conducting a multi-stage Adversary-in-the-Middle (AiTM) phishing operation that abuses legitimate SaaS platforms and recruiter identities to steal corporate Google Workspace credentials and bypass multi-factor authentication.

Google Workspace O-UNC-038 phishing credential-theft aitm social-engineering mfa-bypass saas-abuse google-workspace
2r 9t 1i