Yes, according to my sources, a phishing campaign has been going on since the beginning of the invasion. The problem that knowing exactly who is behind it is a bit difficult, it starts from almost all over the world, and pointing the finger at someone is just unethical: until proven otherwise it can also be the Ukrainians themselves or even criminal groups that are exploiting the situation, not necessarily the Russians.