On Thursday, private security researchers said they had concluded that Mr. Podesta was hacked by Russia’s foreign intelligence service, the GRU, after it tricked him into clicking on a fake Google login page last March, inadvertently handing over his digital credentials.
For months, the hackers mined Mr. Podesta’s inbox for his most sensitive and potentially embarrassing correspondence, much of which has been posted on the WikiLeaks website. Additions to the collection on Thursday included three short email exchanges between Mr. Podesta and Mr. Obama himself in the days leading up to his election in 2008.
Mr. Podesta’s emails were first published by WikiLeaks earlier this month. The release came just days after James R. Clapper Jr., the director of national intelligence, and the Department of Homeland Security publicly blamed Russian officials for cyberattacks on the Democratic National Committee, in what they described as an effort to influence the American presidential election.
To date, no government officials have offered evidence that the same Russian hackers behind the D.N.C. cyberattacks were also behind the hack of Mr. Podesta’s emails, but an investigation by the private security researchers determined that they were the same.
Threat researchers at Dell SecureWorks, an Atlanta-based security firm, had been tracking the Russian intelligence group for more than a year. In June, they reported that they had uncovered a critical tool in the Russian spy campaign. SecureWorks researchers found that the Russian hackers were using a popular link shortening service, called Bitly, to shorten malicious links they used to send targets fake Google login pages to bait them into submitting their email credentials.
The hackers made a critical error by leaving some of their Bitly accounts public, making it possible for SecureWorks to trace 9,000 of their links to nearly 4,000 Gmail accounts targeted between October 2015 and May 2016 with fake Google login pages and security alerts designed to trick users into turning over their passwords.
Among the list of targets were more than 100 email addresses associated with Hillary Clinton’s presidential campaign, including Mr. Podesta’s. By June, 20 staff members for the campaign had clicked on the short links sent by Russian spies. In June, SecureWorks disclosed that among those whose email accounts had been targeted were staff members who advised Mrs. Clinton on policy and managed her travel, communications and campaign finances.
Two security researchers who have been tracking the GRU’s spearphishing campaign confirmed Thursday that Mr. Podesta was among those who had inadvertently turned over his Google email password. The fact that Mr. Podesta was among those breached by the GRU was first disclosed Thursday by Esquire and the Motherboard blog, which published the link Russian spies used against Mr. Podesta.