Threat actor exploited phishing and OAuth abuse to inject malicious code