Multiple espionage clusters are said to use OAuth and WhatsApp abuse across Europe and the United States to take over accounts. Instead of setting up “classic” login pages, the attackers misuse legitimate authentication flows to collect exactly the right information: verification codes, tokens, or device-linking codes.
In a report, researchers from Google Threat Intelligence Group (GTIG) describe three clusters (UNC6293, UNC7005 and UNC5976) targeting people from, among others, academia, aerospace and defense, government organizations and think tanks. The campaigns combine targeted phishing with clever timing and infrastructure that looks trustworthy at first glance.
Why OAuth and WhatsApp abuse is so effective
The standout feature of these attacks is that the “authentication moment” largely feels legitimate. Victims are first directed to a page that makes them think they’re logging into a normal service, after which the real OAuth or WhatsApp linking takes place through the official flow. This benefits the attacker: once a user successfully logs in or links a device, the attack can be extended using stolen tokens or follow-up actions.
According to GTIG, the clusters also make defense extra difficult by acting selectively. For example, UNC6293 would modify small target groups (in one case fewer than five people at the same time), while the lures match diplomatic themes and upcoming events.
UNC6293: app password phishing with diplomatic lures
UNC6293 has been associated with Ice Relic (previously known as APT29) for some time. In earlier campaigns, the cluster would already have misused a Google feature for app-specific passwords to gain control of accounts.
In the recent observations, UNC6293 continues to use phishing, but with an improved approach. The attackers would pose as officials and aim to obtain app password data through automated or targeted requests, tied to themes such as diplomatic activities and conferences.
In June 2026, Google also reported a form of OAuth phishing in which victims, after a legitimate login to an external provider, are asked to share the full URL or a verification code. By receiving that code, the attacker can then, according to Google, gain access to the relevant account.
UNC5976: domains with fake file sharing and token theft
A second cluster, UNC5976, would also rely on authentication-focused phishing. The main difference lies in how tokens are collected and how quickly new infrastructure can be rolled out.
GTIG reports that UNC5976 purchases domains—often using names that resemble file sharing—and then associates them with a cloud project. On the domains, there is a fake page for “file sharing.” A short time later, the page displays a pop-up with a login request.
How the flow works: click “Continue with Google”
- A user visits the fake destination and then sees a pop-up.
- The pop-up contains a button such as “Continue with Google”.
- After successful authentication, the user is redirected to a Google Cloud project URL containing scripts.
- Those scripts would extract the authentication token from the URL and prepare it for later misuse.
According to the researchers, since March 2026 UNC5976 has set up at least twelve new domains and the associated infrastructure. Google disrupted this infrastructure, after which the attackers may have switched to other providers to host their phishing pages.
In addition, UNC5976 would also use a rogue Excel plug-in called HEADRUSH, which would deliver an HTML Application (HTA). That is (according to the description) distributed via a fake domain that imitates a Ukrainian research institute.
UNC7005: device code phishing, linking WhatsApp and extra steps
The third cluster that GTIG highlights is UNC7005 (also referred to as Storm-2945). This cluster would primarily target people in academia and diplomatic circles, including non-profit organizations. Geographically, the focus would extend to, among other places, Ukraine, Western Europe and the United States.
In addition to attacks targeting Google accounts, UNC7005 would also carry out device code phishing against both Microsoft and WhatsApp accounts.
WhatsApp: link to an attacker-controlled device
In May and June 2026, UNC7005 is said to have used social engineering specifically aimed at WhatsApp. The phishing pages would try to get victims to link their account to an attacker-controlled device, so the attackers can then gain access to a “secure WhatsApp call,” chat, or file sharing.
Google describes the approach as follows: once the page is opened, the phishing page asks for a phone number. Next, WhatsApp generates a linking request for the attacker’s device. After that, the page shows the legitimate QR code and linking instructions. If the victim completes the linking successfully, an additional prompt follows for further steps.
According to the description, this can mean the user is lured into:
- joining a voice call, after which JavaScript would attempt to record audio and video and send it to a C2 endpoint;
- choosing an “encrypted chat,” which again requests account details to log in on a second URL;
- downloading a file (details remain unclear).
Additional infostealers: steal data from Windows and macOS
Around the same period, UNC7005 would also have deployed “commodity” infostealers such as Vidar and Atomic (also known as AMOS). These could steal data from Windows and macOS systems to target victims with mailings that lead to websites imitating a “summit resolution.” The lure asks victims to download a companion app to read the full resolution.
CaptiveCrunch and what follows: from a Wi‑Fi portal to token theft
An interesting part of the overview is that CaptiveCrunch would not stand alone from the rest of the activity. Microsoft and others link it to attacks targeting captive Wi‑Fi portals—such as in hotels, conference centers and airports.
The idea is that users are directed via a redirect to a fake login portal. After that, attempts are made to harvest credentials or OAuth tokens. For this, the descriptions indicate, access to administrative parts of Wi‑Fi gateways is also needed so configurations can be changed and DNS traffic can be redirected.
In doing so, the attackers use techniques such as DNS poisoning and “doppelgänger” domains that imitate online services. Microsoft describes that part of the activity would misuse the device code authentication flow in Microsoft Entra ID using an adversary-in-the-middle approach.
What you can do now: practical defensive steps
The key lesson in OAuth and WhatsApp abuse is clear: if authentication steps are used as the entry point, you need fast detection and strong account hygiene. Below are measures that directly match the tactics described.
1) Reduce the impact of stolen tokens
Check whether you have mechanisms for rapid token revocation, strict session policies, and alerting on unusual OAuth or login patterns. Focus on logins from new locations, unusual user agents, and unexpected redirect behavior.
2) Be extra critical of “legitimate” forwarded login flows
If a login process asks you to share, for example, a verification code, a full URL, or other non-standard information, treat it as a red-flag signal. Train users that they should never share codes or links outside the normal flow.
3) Limit app-specific passwords where possible
Since UNC6293 targets app password phishing, it pays to inventory which accounts use app-specific passwords and replace that behavior with stronger methods and strict access rules where possible.
4) Keep device linking and WhatsApp linking in view
For WhatsApp, device linking is a core moment. Ensure you have procedures to verify linked devices and investigate notifications when new linkings occur. Treat an unsolicited “secure call/chat” prompt as suspicious.
5) Pay attention to environmental risk with captive Wi‑Fi
Do you travel often? Prefer a trusted hotspot or a VPN and avoid unnecessary captive portal prompts. Focus your monitoring on redirect patterns and unusual DNS events—especially in locations where the same devices are frequently used to log in.
For additional context about attacks that abuse authentication mechanisms, you can also read previous incidents involving RCE and misuse in account and platform flows, such as Gogs en n8n RCE: what you need to do now. That article covers a different type of vulnerability, but it connects to the broader theme: fast action and good handling after abuse are essential.
Conclusion
The reported activity shows that attackers are increasingly using OAuth and WhatsApp abuse to gain control of real accounts. By combining legitimate login and linking moments with phishing infrastructure and smart follow-up actions, it becomes harder for teams to recognize the attack early.
To defend themselves, organizations should therefore focus on strong account protection, fast detection of anomalous authentication behavior, and clear user training on “never share codes/links”—as well as critically reviewing device linkings and captive Wi‑Fi portals.
Source: https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html
