PARIS (AP) – On the morning of March 19, 2016, Den Katenberg ran a little test with big stakes.
The previous week, Katenberg’s hacking crew had been bombarding the Hillary Clinton campaign’s email accounts with fake Google warnings, trying to get her Brooklyn-based staff to panic, enter their passwords and open their digital lives to Russia’s intelligence services.
But the going was tough. Even when Clinton staffers clicked the malicious links Katenberg crafted, two-factor authentication – a second, failsafe password test – still kept him out of their accounts.
After a day of testing on March 18, he took a different tack, striking the Clinton’s campaign staff at their personal – and generally less secure – Gmail addresses. At 10:30 the next morning he carried out one last experiment, targeting himself at his own Gmail address to make sure his messages weren’t being blocked.
An hour later he sent out a barrage of new malicious messages to more than 70 people, including one to Clinton campaign chair John Podesta. By the end of the day, he’d won access to one of the most important inboxes in American politics.