Suspected Russian hackers abuse OAuth and WhatsApp linking to hijack accounts

Google’s Threat Intelligence Group has identified three suspected Russian espionage clusters, UNC6293, UNC7005, and UNC5976, that abuse legitimate authentication flows to compromise accounts. The groups target individuals in academia, aerospace, defence, government, and think tanks across Europe and the US.

UNC6293, linked to APT29, uses app password and OAuth phishing. UNC5976 automates OAuth token theft via fake file-sharing pages. UNC7005 has conducted device code phishing against Microsoft and WhatsApp, and has used OAuth phishing to steal tokens.

Google says it has disrupted infrastructure associated with these clusters.