Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Summary: Google Threat Intelligence Group reported that three suspected Russian espionage clusters - UNC6293, UNC7005, and UNC5976 - are using legitimate authentication flows, including OAuth phishing, app password phishing, and WhatsApp device linking, to target academia, aerospace and defense, governments, and think tanks in Europe and the U.S. UNC7005 registered domains spoofing the Finnish Operations Center from July 31, 2026 and sent targeted phishing emails to European defense industry targets between August 6 and August 13, 2026, while UNC5976 created at least 12 new phishing domains since March 2026 and Lumen identified roughly 70 victim IP addresses tied to the related CaptiveCrunch Wi-Fi portal campaign.
Key Takeaway: These groups do not break authentication - they persuade targets to complete it, through a real Google login page, a real WhatsApp link code, or a hotel Wi-Fi portal, so a valid session token becomes the intrusion. Lumen's finding that several Managed Service Providers may have been compromised to reach the Wi-Fi gateways they manage puts the trust your organization places in a provider directly in the path of the attack.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026