Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Three suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to compromise personal accounts across multiple platforms
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976.
Threat Cluster Overview
The threat clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms. According to Google Threat Intelligence Group researchers, these clusters have been found to mainly target academia, diplomatic, and nonprofit personnel across Ukraine, Western Europe, and the U.S.
Phishing Tactics
The threat actors have been observed using various phishing tactics, including OAuth phishing and device code phishing. UNC6293, for example, has been found to conduct OAuth phishing by requesting targets to share either the full URL or verification code after performing a legitimate login to an external provider. Once the requested verification code is provided, it allows the attackers to access the target's account.
Comparison of Threat Clusters
The following table compares the threat clusters:
| Cluster | Targeted Industries | Geographic Targeting | Tactics |
|---|---|---|---|
| UNC6293 | Academia, aerospace and defense, governments, think tanks | Europe, U.S. | OAuth phishing, app password phishing |
| UNC7005 | Academia, diplomatic, nonprofit | Ukraine, Western Europe, U.S. | OAuth phishing, device code phishing, WhatsApp linking |
| UNC5976 | Military, aerospace, defense industrial base, NGOs/think tanks | Ukraine, Armenia | OAuth phishing, cloud infrastructure abuse |
The threat actors have also been found to use various tools and techniques, including commodity infostealers like Vidar and Atomic, to siphon data from Windows and macOS hosts. In addition, they have been observed leveraging rogue Excel plugins and HTML Applications to deliver malware.
The activity of these threat clusters has been ongoing since at least March 2026, with UNC7005 emerging as the core focus of Google's research. The threat actor has been found to mainly target academia, diplomatic, and nonprofit personnel across Ukraine, Western Europe, and the U.S. Its operational focus is primarily centered on the military, aerospace, defense industrial base, and NGOs/think tanks.
Users are advised to be cautious when receiving phishing emails or messages, and to never provide sensitive information such as verification codes or passwords. It is also recommended to use two-factor authentication and to keep software and operating systems up to date to prevent exploitation of known vulnerabilities.
