Russian Hackers Hijack Accounts via Google OAuth and WhatsApp Device Linking

Google Threat Intelligence Group (GTIG) researchers Gabby Roncone and Wesley Shields have published a report on three clusters they attribute to Russian cyberespionage operations: UNC6293, UNC7005 and UNC5976. What they have in common isn't exploits or backdoors but the abuse of entirely legitimate login mechanisms. That is exactly what makes them so awkward for defenders: telling a lawful account access apart from a malicious one becomes difficult.

The targets have been staff at universities, think tanks, and diplomatic and defense bodies in Europe and the US, as well as in Ukraine and Armenia. The campaigns are small and targeted — sometimes fewer than five recipients at a time.

App passwords, OAuth and confirmation codes

UNC6293, believed to be a subgroup of Ice Relic (formerly APT29, also known as Cozy Bear and Midnight Blizzard), previously hijacked accounts through Google's “app passwords” feature, impersonating State Department staff with lures on diplomatic themes. In the summer of 2026 the group shifted to OAuth phishing: after a legitimate login, the victim is asked to forward the full URL or the confirmation code — which is enough to access their account.

UNC5976 bought domains with “file-sharing” names and set up fake file-exchange pages on them featuring a “Continue with Google” button. The button led to Google's real login page, after which the user was redirected to the attackers' cloud project, where scripts intercepted the authentication token. Since March 2026 at least 12 domains have been created; Google took them down, and the group began looking for other infrastructure.

Wine lures and WhatsApp linking

GTIG pays particular attention to UNC7005 (also known as Storm-2945). Besides phishing app passwords and device codes for Microsoft, the group has kept a long-standing Ice Relic signature — invitations to events at which the victim is politely asked about their food and wine preferences (this “wine” theme has run since 2023).

In the spring of 2026 UNC7005 impersonated WhatsApp: on the pretext of a “secure call,” the victim was offered a chance to link their account to the attacker's device. The user entered a phone number, received a genuine QR code and linking code — and after connecting was invited to join a voice call (JavaScript secretly recorded audio and video), open an “encrypted chat,” or download a file. Later the group added the commercial infostealers Vidar and Atomic (AMOS) to its arsenal, along with OAuth phishing using domains that mimicked a Finnish support center for defense companies.

GTIG stresses that the creative use of legitimate features makes it possible to quickly siphon off data and send out new phishing from compromised, entirely genuine accounts.

Source: The Hacker News