Russian Hackers Abuse OAuth and WhatsApp Device Linking to Hijack High-Value Accounts
Brief
Suspected Russian cyber-espionage groups are increasingly turning ordinary sign-in and device-linking features into tools for account takeover.
Their latest campaigns do not depend on breaking passwords or exploiting a software flaw. Instead, they persuade targets to approve actions that appear legitimate.
The activity has targeted people in academia, aerospace, defense, government, nonprofit organizations, and think tanks across Europe and the United States.
Attackers use tailored conference invitations, diplomatic themes, file-sharing offers, and messages that create pressure to authenticate quickly.
Analysts at Google Cloud identified three distinct clusters, tracked as UNC6293, UNC7005, and UNC5976, using phishing, OAuth abuse, app-password theft, device-code lures, and malware.